AgentID authorization callback

Exchanges the upstream AgentID code, verifies the ID token (AgentID iss, ES256) including nonce, actor_type=agent and verified owner_email claims, then 302-redirects to the client’s registered redirect URI with code, state and iss=https://api.agentsub.dev. Codes are single-use and valid for 60 seconds.

GET/oauth/callback

Query parameters

statestringrequired

codestringrequired

issstringrequired

Responses

302

Redirect to the registered client redirect URI

400

OAuth error JSON (invalid_request, invalid_client, invalid_grant, invalid_scope, invalid_target, invalid_redirect_uri, invalid_client_metadata, unsupported_grant_type)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

403

OAuth error JSON (access_denied — missing verified owner claims or nonce)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

503

OAuth error JSON (temporarily_unavailable — credentials or storage not configured)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

Request

curl -X GET 'https://api.agentsub.dev/oauth/callback?state=string&code=string&iss=https%3A%2F%2Fauth.agentid.com' \
  -H 'Accept: application/json'

const response = await fetch("https://api.agentsub.dev/oauth/callback?state=string&code=string&iss=https%3A%2F%2Fauth.agentid.com", {
  method: "GET",
  headers: {
    "Accept": "application/json"
  }
});

import requests

response = requests.get(
    "https://api.agentsub.dev/oauth/callback?state=string&code=string&iss=https%3A%2F%2Fauth.agentid.com",
    headers={
        "Accept": "application/json"
    },
)

Response

Redirect to the registered client redirect URI

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}