Authorization: Bearer abc123xyz_still_valid_since_2022 Authorization: Bearer abc123xyz_still_valid_since_2022 Authorization: Bearer abc123xyz_still_valid_since_2022 Authorization: OathMesh eyJhbGciOiJFZERTQSIsInR5cCI6Im9tK2p3dCJ9... └── expires in 300 seconds. enforced. not optional. Authorization: OathMesh eyJhbGciOiJFZERTQSIsInR5cCI6Im9tK2p3dCJ9... └── expires in 300 seconds. enforced. not optional. Authorization: OathMesh eyJhbGciOiJFZERTQSIsInR5cCI6Im9tK2p3dCJ9... └── expires in 300 seconds. enforced. not optional. r.Use(middleware.OathMeshMiddleware(cfg)) // Fully typed caller context in your handler: caller := middleware.CallerFrom(r.Context()) // caller.Principal.Subject → "agent://ci/deploy-bot" // caller.Action → "deploy" // caller.TokenID → unique jti for this call r.Use(middleware.OathMeshMiddleware(cfg)) // Fully typed caller context in your handler: caller := middleware.CallerFrom(r.Context()) // caller.Principal.Subject → "agent://ci/deploy-bot" // caller.Action → "deploy" // caller.TokenID → unique jti for this call r.Use(middleware.OathMeshMiddleware(cfg)) // Fully typed caller context in your handler: caller := middleware.CallerFrom(r.Context()) // caller.Principal.Subject → "agent://ci/deploy-bot" // caller.Action → "deploy" // caller.TokenID → unique jti for this call from oathmesh import verify_token, OathMeshError @app.post("/deploy") async def deploy(request: Request): try: caller = verify_token(request.headers["authorization"], config) except OathMeshError as e: raise HTTPException(status_code=401, detail=str(e)) return {"deployed_by": caller.principal.subject} from oathmesh import verify_token, OathMeshError @app.post("/deploy") async def deploy(request: Request): try: caller = verify_token(request.headers["authorization"], config) except OathMeshError as e: raise HTTPException(status_code=401, detail=str(e)) return {"deployed_by": caller.principal.subject} from oathmesh import verify_token, OathMeshError @app.post("/deploy") async def deploy(request: Request): try: caller = verify_token(request.headers["authorization"], config) except OathMeshError as e: raise HTTPException(status_code=401, detail=str(e)) return {"deployed_by": caller.principal.subject} import { withOathMesh } from '@oathmesh/oathmesh/next'; const oathmesh = withOathMesh({ audience, trustedIssuers }); export async function POST(request: NextRequest) { const { caller, error } = await oathmesh(request); if (error) return error; // typed 401 — missing, invalid, expired, replayed return NextResponse.json({ subject: caller.principal.subject }); } import { withOathMesh } from '@oathmesh/oathmesh/next'; const oathmesh = withOathMesh({ audience, trustedIssuers }); export async function POST(request: NextRequest) { const { caller, error } = await oathmesh(request); if (error) return error; // typed 401 — missing, invalid, expired, replayed return NextResponse.json({ subject: caller.principal.subject }); } import { withOathMesh } from '@oathmesh/oathmesh/next'; const oathmesh = withOathMesh({ audience, trustedIssuers }); export async function POST(request: NextRequest) { const { caller, error } = await oathmesh(request); if (error) return error; // typed 401 — missing, invalid, expired, replayed return NextResponse.json({ subject: caller.principal.subject }); } git clone https://github.com/oathmesh/oathmesh.git && cd oathmesh docker-compose up -d # Mint a token (300s = the maximum, enforced by the issuer) TOKEN=$(docker compose exec oathmesh ./bin/oathmesh mint \ --sub "agent://repo/acme/deploy-bot" \ --aud "https://inventory.internal" \ --act "deploy" \ --ttl 300 \ --quiet) curl -H "Authorization: OathMesh $TOKEN" http://localhost:8081/inventory git clone https://github.com/oathmesh/oathmesh.git && cd oathmesh docker-compose up -d # Mint a token (300s = the maximum, enforced by the issuer) TOKEN=$(docker compose exec oathmesh ./bin/oathmesh mint \ --sub "agent://repo/acme/deploy-bot" \ --aud "https://inventory.internal" \ --act "deploy" \ --ttl 300 \ --quiet) curl -H "Authorization: OathMesh $TOKEN" http://localhost:8081/inventory git clone https://github.com/oathmesh/oathmesh.git && cd oathmesh docker-compose up -d # Mint a token (300s = the maximum, enforced by the issuer) TOKEN=$(docker compose exec oathmesh ./bin/oathmesh mint \ --sub "agent://repo/acme/deploy-bot" \ --aud "https://inventory.internal" \ --act "deploy" \ --ttl 300 \ --quiet) curl -H "Authorization: OathMesh $TOKEN" http://localhost:8081/inventory npm install @oathmesh/sdk pip install oathmesh go install github.com/oathmesh/oathmesh/cmd/oathmesh@latest npm install @oathmesh/sdk pip install oathmesh go install github.com/oathmesh/oathmesh/cmd/oathmesh@latest npm install @oathmesh/sdk pip install oathmesh go install github.com/oathmesh/oathmesh/cmd/oathmesh@latest - 300s max TTL is enforced in the issuer — there's no config flag to make it longer. Intentional, not an oversight. - Ed25519 only — one algorithm, the correct one. Algorithm confusion attacks aren't possible. - Fail-closed verification — all 14 steps must pass. No partial-valid state. - Full audit trail — every allow and every deny logged as NDJSON. grep-able. Cloud-native. - Gateway mode — zero changes to your existing APIs. - MIT license — take it, fork it, self-host it. What we know needs work ❌ - It's v0.1.0 — rough edges exist. Read the threat model before running in production. - You need to run an Issuer service — one more thing to deploy and keep alive. Real operational cost. - Horizontal scaling needs Redis — the replay cache is in-memory by default. Multiple instances need a shared Redis. We're not hiding this. - Pkl for policies — powerful, but not everyone knows Apple Pkl. A visual editor is on the roadmap. - Machine-to-machine only — user auth is a different problem. Use OAuth2/OIDC for that. - You're running CI/CD pipelines that call internal APIs - You have service-to-service calls in a zero-trust or service mesh setup - You're building AI agents that call protected services - A leaked credential in your environment would cause real damage Don't use OathMesh (yet) if - You need tokens that live longer than 5 minutes by design - You can't add infrastructure — the Issuer service is not optional