Verify a registered agent key.

Origin: https://app.example.com
X-AF-Site-Key: afv_pk_test_...

Authorization: Bearer afv_sk_test_...

curl https://af.mayoflux.tv/api/v1/challenges \
  --request POST \
  --header "Origin: https://app.example.com" \
  --header "X-AF-Site-Key: $AF_SITE_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "action": "orders:approve",
    "audience": "orders-api",
    "resource": "https://api.example.com/orders/ord_123",
    "scopes": ["orders:approve"],
    "context_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "requested_agent_id": "agt_..."
  }'

{
  "object": "af_verify.challenge",
  "challenge": {
    "protocol": "AFV2",
    "issuer": "https://af.mayoflux.tv",
    "id": "afc_...",
    "organization_id": "org_...",
    "project_id": "prj_...",
    "nonce": "...",
    "site_key": "afv_pk_test_...",
    "origin": "https://app.example.com",
    "action": "orders:approve",
    "audience": "orders-api",
    "resource": "https://api.example.com/orders/ord_123",
    "scopes": ["orders:approve"],
    "context_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "issued_at_unix": 1784167620,
    "expires_at_unix": 1784167680
  },
  "agent_url": "https://af.mayoflux.tv/v1/challenges/afc_...",
  "verify_url": "https://af.mayoflux.tv/v1/challenges/afc_.../verify",
  "status_url": "https://af.mayoflux.tv/v1/challenges/afc_.../status",
  "poll_token": "..."
}

AFV2
issuer_b64=<base64url(issuer UTF-8)>
challenge_id=<challenge.id>
organization_id=<organization_id>
project_id=<project_id>
site_key=<site_key>
nonce=<nonce>
origin_b64=<base64url(origin UTF-8)>
action_b64=<base64url(action UTF-8)>
audience_b64=<base64url(audience UTF-8)>
resource_b64=<base64url(resource UTF-8)>
scopes_b64=<base64url(JSON.stringify(sorted_scopes) UTF-8)>
context_sha256=<64 lowercase hex>
issued_at_unix=<integer>
expires_at_unix=<integer>
agent_id=<registered agent id>
key_id=<registered key id>

import { readFile } from 'node:fs/promises';
import { sign } from 'node:crypto';

const agentId = process.env.AF_AGENT_ID;
const keyId = process.env.AF_AGENT_KEY_ID;
const challengeUrl = process.argv[2];
const envelope = await fetch(challengeUrl).then(async (response) => {
  if (!response.ok) throw new Error(`Challenge failed: ${response.status}`);
  return response.json();
});
const c = envelope.challenge;

if (c.issuer !== 'https://af.mayoflux.tv') throw new Error('Untrusted issuer');
if (c.expires_at_unix <= Math.floor(Date.now() / 1000)) throw new Error('Expired');
if (c.audience !== 'orders-api') throw new Error('Audience not allowed');
if (c.action !== 'orders:approve') throw new Error('Action not allowed');

const b64 = (value) => Buffer.from(value, 'utf8').toString('base64url');
const scopes = [...new Set(c.scopes.map((value) => String(value).trim()))].sort();
const canonical = [
  'AFV2',
  `issuer_b64=${b64(c.issuer)}`,
  `challenge_id=${c.id}`,
  `organization_id=${c.organization_id}`,
  `project_id=${c.project_id}`,
  `site_key=${c.site_key}`,
  `nonce=${c.nonce}`,
  `origin_b64=${b64(c.origin)}`,
  `action_b64=${b64(c.action)}`,
  `audience_b64=${b64(c.audience)}`,
  `resource_b64=${b64(c.resource)}`,
  `scopes_b64=${b64(JSON.stringify(scopes))}`,
  `context_sha256=${c.context_sha256}`,
  `issued_at_unix=${c.issued_at_unix}`,
  `expires_at_unix=${c.expires_at_unix}`,
  `agent_id=${agentId}`,
  `key_id=${keyId}`,
].join('\n');

const privateKey = await readFile(process.env.AF_AGENT_PRIVATE_KEY);
const signature = sign(null, Buffer.from(canonical, 'utf8'), privateKey)
  .toString('base64url');

const result = await fetch('https://af.mayoflux.tv/api/v1/verifications', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    challenge_id: c.id,
    agent_id: agentId,
    key_id: keyId,
    signature,
    algorithm: 'Ed25519',
  }),
});

console.log(await result.json());

import base64
import json
import os
import time
import requests
from cryptography.hazmat.primitives.serialization import load_pem_private_key

def b64(value: str) -> str:
    return base64.urlsafe_b64encode(value.encode()).rstrip(b"=").decode()

agent_id = os.environ["AF_AGENT_ID"]
key_id = os.environ["AF_AGENT_KEY_ID"]
envelope = requests.get(os.environ["AF_CHALLENGE_URL"], timeout=10).json()
c = envelope["challenge"]

if c["issuer"] != "https://af.mayoflux.tv": raise RuntimeError("Untrusted issuer")
if c["expires_at_unix"] <= int(time.time()): raise RuntimeError("Expired")

scopes = sorted(set(str(value).strip() for value in c["scopes"]))
canonical = "\n".join([
    "AFV2",
    f"issuer_b64={b64(c['issuer'])}",
    f"challenge_id={c['id']}",
    f"organization_id={c['organization_id']}",
    f"project_id={c['project_id']}",
    f"site_key={c['site_key']}",
    f"nonce={c['nonce']}",
    f"origin_b64={b64(c['origin'])}",
    f"action_b64={b64(c['action'])}",
    f"audience_b64={b64(c['audience'])}",
    f"resource_b64={b64(c['resource'])}",
    f"scopes_b64={b64(json.dumps(scopes, separators=(',', ':')))}",
    f"context_sha256={c['context_sha256']}",
    f"issued_at_unix={c['issued_at_unix']}",
    f"expires_at_unix={c['expires_at_unix']}",
    f"agent_id={agent_id}",
    f"key_id={key_id}",
])

with open(os.environ["AF_AGENT_PRIVATE_KEY"], "rb") as key_file:
    private_key = load_pem_private_key(key_file.read(), password=None)

signature = base64.urlsafe_b64encode(
    private_key.sign(canonical.encode())
).rstrip(b"=").decode()

result = requests.post(
    "https://af.mayoflux.tv/api/v1/verifications",
    json={"challenge_id": c["id"], "agent_id": agent_id,
          "key_id": key_id, "signature": signature,
          "algorithm": "Ed25519"},
    timeout=10,
)
print(result.json())

curl https://af.mayoflux.tv/v1/siteverify \
  --request POST \
  --header "Authorization: Bearer $AF_SECRET_KEY" \
  --header "Content-Type: application/json" \
  --data "{
    \"response\": \"$AF_PASS_TOKEN\",
    \"expected_action\": \"orders:approve\",
    \"expected_origin\": \"https://app.example.com\",
    \"expected_audience\": \"orders-api\",
    \"expected_resource\": \"https://api.example.com/orders/ord_123\",
    \"required_scopes\": [\"orders:approve\"],
    \"expected_context_sha256\": \"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef\"
  }"

{
  "active": true,
  "success": true,
  "protocol": "AFV2",
  "challenge_id": "afc_...",
  "agent_id": "agt_...",
  "agent_key_id": "agk_...",
  "site_key": "afv_pk_test_...",
  "origin": "https://app.example.com",
  "action": "orders:approve",
  "audience": "orders-api",
  "resource": "https://api.example.com/orders/ord_123",
  "scopes": ["orders:approve"],
  "assurance": "registered-agent-key",
  "consumed": true
}

<script defer src="https://af.mayoflux.tv/widget/v1/af-verify.js"></script>

<form action="/approve-order" method="post">
  <div
    class="af-verify"
    data-sitekey="afv_pk_test_..."
    data-action="orders:approve"
    data-audience="orders-api"
    data-resource="https://api.example.com/orders/ord_123"
    data-scopes="orders:approve"
    data-context-sha256="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
    data-requested-agent-id="agt_..."
    data-response-field="af-response">
  </div>
  <button type="submit">Approve order</button>
</form>

const widget = document.querySelector('.af-verify');

widget.addEventListener('af:challenge', ({ detail }) => {
  console.log(detail.challenge_id, detail.agent_url, detail.expires_at_unix);
});

widget.addEventListener('af:verified', ({ detail }) => {
  console.log('Pass ready for server verification', detail.assurance);
});

widget.addEventListener('af:error', ({ detail }) => {
  console.error(detail.code, detail.message);
});

const result = await AFVerify.open({
  siteKey: 'afv_pk_test_...',
  action: 'orders:approve',
  audience: 'orders-api',
  resource: 'https://api.example.com/orders/ord_123',
  scopes: ['orders:approve'],
  requestedAgentId: 'agt_...'
});

if (result.verified) {
  // Send result.pass_token to your backend for redemption.
}

import { createRemoteJWKSet, jwtVerify } from 'jose';

const jwks = createRemoteJWKSet(
  new URL('https://af.mayoflux.tv/.well-known/jwks.json')
);
const { payload, protectedHeader } = await jwtVerify(token, jwks, {
  algorithms: ['EdDSA'],
  issuer: 'https://af.mayoflux.tv',
  audience: 'orders-api',
  clockTolerance: 5,
});

if (protectedHeader.typ !== 'AFV+JWT') throw new Error('Wrong token type');
if (payload.azp !== process.env.AF_SITE_KEY) throw new Error('Wrong site key');
if (payload.ver !== 'AFV2') throw new Error('Wrong protocol');
if (payload.action !== 'orders:approve') throw new Error('Wrong action');
if (payload.resource !== expectedResource) throw new Error('Wrong resource');
if (!payload.scopes.includes('orders:approve')) throw new Error('Missing scope');
if (payload.assurance !== 'registered-agent-key') throw new Error('Wrong assurance');

curl "$AF_STATUS_URL" \
  --header "X-AF-Poll-Token: $AF_POLL_TOKEN"

{
  "error": {
    "code": "challenge_expired",
    "message": "Challenge has expired."
  },
  "request_id": "req_..."
}