AI Agent Authorization: The Complete Guide for 2026

import { Grantex } from '@grantex/sdk';

const gx = new Grantex({
  apiKey: process.env.GRANTEX_API_KEY,
  baseUrl: 'https://grantex-auth-dd4mtrt2gq-uc.a.run.app',
});

// 1. Register the agent with its own identity
const agent = await gx.agents.create({
  name: 'expense-report-agent',
  description: 'Files expense reports and reads receipts',
});

// 2. Request scoped authorization from the user
const auth = await gx.authorize({
  agentId: agent.id,
  userId: 'user_alice',
  scopes: ['expenses:read', 'expenses:create'],
  callbackUrl: 'https://app.example.com/callback',
});
// Redirect user to auth.consentUrl — they see the exact scopes

// 3. After user approves, exchange the code for a grant token
const token = await gx.tokens.exchange({
  code: callbackCode,
  agentId: agent.id,
});

// 4. Verify the token before every action
const result = await gx.tokens.verify(token.grantToken);
console.log(result.scopes);    // ['expenses:read', 'expenses:create']
console.log(result.agent);     // 'did:grantex:ag_01ABC...'
console.log(result.principal); // 'user_alice'
console.log(result.expiresAt); // '2026-04-06T00:00:00Z'

from grantex import Grantex

gx = Grantex(
    api_key=os.environ["GRANTEX_API_KEY"],
    base_url="https://grantex-auth-dd4mtrt2gq-uc.a.run.app",
)

agent = gx.agents.create(name="expense-report-agent", description="Files expense reports")

auth = gx.authorize(
    agent_id=agent.id,
    user_id="user_alice",
    scopes=["expenses:read", "expenses:create"],
    callback_url="https://app.example.com/callback",
)

token = gx.tokens.exchange(code=callback_code, agent_id=agent.id)

result = gx.tokens.verify(token.grant_token)
# result.scopes == ['expenses:read', 'expenses:create']

import { Grantex } from '@grantex/sdk';
import { salesforceManifest } from '@grantex/sdk/manifests/salesforce';

const gx = new Grantex({ apiKey: 'gx_...' });
gx.loadManifest(salesforceManifest);

// This checks the JWT's scopes against the manifest — no network call
const check = await gx.enforce({
  grantToken: token.grantToken,
  connector: 'salesforce',
  tool: 'delete_contact',
});

if (!check.allowed) {
  console.log(check.reason); // "Token lacks tool:salesforce:delete scope"
}