open source · MIT · TypeScript

The auth layer for AI agents.

corri is open-source middleware that checks a signed agent's identity and applies your access policy (allow, deny, or charge) before your protected code runs. Add it in one line.

Get started Live demoGitHub$npm install @corri/sdk
why corri

Everything you need. Nothing you don't.

Open source, yours

MIT licensed. Self-host it anywhere, read every line, no vendor lock-in, no account required.

One line to add

createCorri({ agents }), then wrap your handler. The secret, issuer and policy all have sane defaults.

Real agent identity

Cryptographic signatures (RFC 9421 / Web Bot Auth). Not IP lists or user-agent guessing.

Get paid per request

Agents with wallets pay USDC over x402, straight to your address. Verified before your code runs.

Signed receipts

Portable, offline-verifiable proof of who accessed what, under which terms.

Tiny & fast

~10 KB, WebCrypto, edge-ready, near-zero dependencies. 155 tests. Nothing you have to run.

the whole integration

Declare who you trust. Wrap your handler.

A robot knocks on your door. corri checks its ID. If it's allowed in, it comes in. If it has to pay first, it pays. That's the whole integration.

lib/corri.ts + app/api/report/route.ts
import { createCorri } from "@corri/sdk/server";

// The only required field: who you trust.
export const corri = createCorri({
  agents: { "research-agent.example": AGENT_PUBLIC_JWK }
});

// app/api/report/route.ts: the one line that protects it.
export const GET = corri.protect(async () =>
  Response.json({ report: await loadReport() })  // runs only once authorized
);

Want to charge for access? Add access: "paid", price and pay: { wallet }. Nothing else to wire.