SharkAuth – Open-source identity provider for AI agent delegation with RFC 8693 Token Exchange and DPoP

SharkAuth is a single ~29 MB static Go binary with embedded SQLite that implements OAuth 2.1 RFC 8693 Token Exchange and RFC 9449 DPoP (Demonstrating Proof-of-Possession), treating AI agents as first-class identities with cryptographically bound tokens and revocable delegation grants.

The system addresses agent-to-agent delegation by issuing may_act_grants that are time-limited and hop-constrained, and binds every token to an agent's private key so that tokens stolen via prompt injection or log leak cannot be used without the key.

SharkAuth ships as open-source (MIT licensed), requires zero configuration, runs with no external dependencies (no Postgres, Redis, or Docker needed), and collects only a one-time anonymous install_id ping by default with telemetry opt-out available.