OIDC Helper

Login bootstrap

The SDK TokenDanceID helper creates the authorization URL, state, nonce, code verifier, and S256 code challenge, then provides login/callback diagnostics and state verification. Hub Server owns code exchange, ID token validation, and session issuance — see the AgentHub docs for the full identity flow.

import { createTokenDanceIdLoginRequest, verifyTokenDanceIdCallback } from "@tokendance/code-sdk";

const login = createTokenDanceIdLoginRequest({
  clientId: "agenthub-local",
  redirectUri: "http://127.0.0.1:48731/callback"
});

openSystemBrowser(login.authorizationUrl);
const callback = verifyTokenDanceIdCallback(callbackUrlFromLoopbackServer, login);

Identity boundary

AgentHub Hub Server validates JWKS/issuer/audience/expiration, maps tokendance_sub, and issues Hub-local sessions. Gateway model calls use TokenDance API keys; OIDC access tokens belong to identity sessions.