Library

How getAuth identifies the signed-in user and forwards their credentials to your API.

The agent acts as the signed-in user. In getAuth you verify the request the way your API does, and return:

getAuth: async (req) => {
  const user = await verifySession(req); // your code; return null to reject
  if (!user) return null;
  return { userId: user.id, headers: { authorization: req.headers.get("authorization")! } };
}

• userId scopes chat threads: a user can only see their own history.
• headers are forwarded to your API on every tool call, so your API enforces its normal permissions. The agent never has more access than the user.

Credentials must travel in Authorization#

The browser can only send content-type and authorization to the endpoint, so credentials must travel in Authorization. Cookies are not forwarded.