Documentation

corri is open-source middleware (a TypeScript SDK) that answers one question for every AI-agent request before your code runs: who is this agent, and on what terms may it access this?

Install it, protect a route, done, everything below is optional depth.

npm install @corri/sdk
npx corri init
npx corri test

It is built entirely on open standards:

Identity, HTTP Message Signatures (RFC 9421) with the web-bot-auth tag (Cloudflare Web Bot Auth), Ed25519 keys, replay protection.
Policy, a deterministic, side-effect-free rules engine over principals, actions, purposes, and resources. Four effects: allow, deny, challenge, charge.
Payments, the x402 protocol: charge decisions produce a standard 402 response, paying agents settle USDC to your wallet through a facilitator.
Receipts, every successful access returns a signed JWS receipt that verifies offline.
Licensing, publish the same policy as an RSL 1.0 machine-readable license document.

The four outcomes

Status	Effect	Meaning	Body
`401`	`challenge`	No (or invalid) signed agent identity.	`{ error: "agent_identity_required", … }`
`402`	`charge`	Identity verified; an entitlement or payment is required.	`{ error: "entitlement_required", … }`
`200`	`allow` / satisfied `charge`	Your handler runs; the response carries an `Access-Receipt` header.	Your content
`403`	`deny`	Policy prohibits this access; payment cannot override it.	`{ error: "policy_denied", reason }`

Sixty-second tour

The createCorri facade wires all five layers with smart defaults. This is a complete, production-shaped integration:

lib/corri.ts + route.tsts

import { createCorri } from "@corri/sdk/server";

export const corri = createCorri({
  issuer: "https://your-site.com",
  secret: process.env.CORRI_SECRET!,        // one secret → your receipt key
  price: "0.01",                            // charge agents per read
  denyPurposes: ["training"],               // refuse training use
  pay: { wallet: "0xYourWallet" },          // USDC settles straight to you
  agents: { "research-agent.example": AGENT_PUBLIC_JWK } // who you trust
});

// Any framework that speaks web-standard Request/Response:
export const GET = corri.protect("report:weekly", async () =>
  Response.json({ report: await loadReport() })   // runs only once authorized
);

Need hand-tuned rules, API-key access, or a Redis replay store? createCorri is a thin facade over createAgentAccess, every default is overridable, and you can drop to the full API any time.

Where to go next

Quickstart, install, protect a route, make a signed agent call.
Agent identity, how signature verification works on the wire.
Access policies, the rules engine, matching, and precedence.
Payments & 402, x402, facilitators, API keys.
Access receipts, signed JWS proofs and verification.
RSL licensing, machine-readable license documents.
API reference, every export, typed.
Live demo, the whole pipeline, running in this site.

Quickstart →