Authorization Server

import "net/netip"

a, _ := theauth.New(theauth.Config{
    Storage:       store,
    BaseURL:       "https://as.example.com",
    EncryptionKey: []byte(os.Getenv("ENCRYPTION_KEY")), // 32-byte AES-256

    AuthorizationServer: &theauth.AuthorizationServerConfig{
        Issuer: "https://as.example.com",
        Resources: []theauth.ProtectedResource{
            {
                Identifier: "https://api.example.com",
                Scopes:     []string{"read", "write"},
            },
        },
    },
})

AuthorizationServer: &theauth.AuthorizationServerConfig{
    Issuer: "https://as.example.com",

    // Bearer-gated DCR (recommended for production):
    RegistrationTokens:             []string{os.Getenv("DCR_TOKEN")},
    RegistrationRateLimitPerMinute: 5,

    // OR allow anonymous registration (public MCP profile):
    AllowAnonymousRegistration:     true,   // rate-limited to 1 req/min by default
},

a, _ := theauth.New(theauth.Config{
    // ...
    AuthorizationServer: &theauth.AuthorizationServerConfig{ /* ... */ },
    AgentIdentity: &theauth.AgentConfig{
        MaxChainDepth: 3, // hard ceiling is 3
    },
    AccountUX: true, // expose /account/agents and /account/delegations
})

agent, secret, err := a.CreateAgent(ctx, theauth.CreateAgentInput{
    Owner: theauth.AgentOwner{UserID: &userID}, // or OrganizationID for an org-owned agent
    Name:  "my-mcp-agent",
    Scope: []string{"read", "write"},
})

Config{
    TrustedProxies: []netip.Prefix{
        netip.MustParsePrefix("10.0.0.0/8"),
    },
}

GET  /admin/v1/organizations/{orgID}/agents
POST /admin/v1/organizations/{orgID}/agents
GET  /admin/v1/organizations/{orgID}/delegations
POST /admin/v1/organizations/{orgID}/delegations
DELETE /admin/v1/organizations/{orgID}/delegations/{id}