Authentication Methods & Security

// JavaScript
const agent = new AgentCorex({
  apiKey: process.env.AGENT_COREX_API_KEY
});

// cURL
curl -H "Authorization: Bearer acx_live_xxx" \
  https://api.agent-corex.com/v1/retrieve_tools

curl "https://api.agent-corex.com/v1/retrieve_tools?api_key=acx_live_xxx"

// 1. User clicks "Connect Agent-CoreX"
const authUrl = `https://auth.agent-corex.com/authorize?
client_id=YOUR_CLIENT_ID&
redirect_uri=https://yourapp.com/callback&
scope=read:tools,execute:tools`;

// 2. User grants permission
// 3. Receive authorization code

// 4. Exchange for access token
const response = await fetch('https://auth.agent-corex.com/token', {
  method: 'POST',
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: authCode,
    client_id: CLIENT_ID,
    client_secret: CLIENT_SECRET,
    redirect_uri: REDIRECT_URI
  })
});

const { access_token } = await response.json();

// 5. Use access token
const agent = new AgentCorex({
  accessToken: access_token
});

import jwt from 'jsonwebtoken';

// 1. Create JWT
const token = jwt.sign(
  {
    sub: 'service-id',
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + 3600
  },
  process.env.JWT_SECRET,
  { algorithm: 'HS256' }
);

// 2. Use in requests
fetch('https://api.agent-corex.com/v1/retrieve_tools', {
  headers: {
    'Authorization': `Bearer ${token}`
  }
});

// Verify webhook signature
import crypto from 'crypto';

function verifyWebhookSignature(payload, signature) {
  const expectedSig = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSig)
  );
}

// In webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-agent-corex-signature'];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhookSignature(payload, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process webhook
  res.json({ ok: true });
});

# Every month:
1. Generate new API key
2. Update all systems with new key
3. Test thoroughly
4. Revoke old key

// ❌ Don't: One key for everything
const adminKey = 'acx_live_full_access';

// ✅ Do: Different keys for different scopes
const deploymentKey = 'acx_live_deploy_only';
const readKey = 'acx_live_read_only';

# Development
AGENT_COREX_API_KEY=acx_test_dev_xxx

# Staging
AGENT_COREX_API_KEY=acx_test_staging_xxx

# Production
AGENT_COREX_API_KEY=acx_live_prod_xxx

import RateLimit from 'express-rate-limit';

const limiter = RateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  message: 'Too many requests, please try again later.'
});

app.use(limiter);

// ❌ Never use HTTP
// http://api.agent-corex.com/retrieve_tools

// ✅ Always use HTTPS
// https://api.agent-corex.com/retrieve_tools

try {
  const tools = await agent.retrieveTools({
    query: "Deploy"
  });
} catch (error) {
  if (error.status === 401) {
    // API key invalid or expired
    // Regenerate key and update code
  }
}

catch (error) {
  if (error.status === 403) {
    // Permission denied (quota exceeded, etc)
    // Check your usage limits
  }
}