SDK Authentication

How verify-access calls are authenticated and how caller metadata is forwarded.

/api/agents/verify-access is authenticated — every call must identify the caller so attribution, rate limits, and the Discovered flow work correctly. Authenticate with an API key:

API key

Authorization: Bearer kya_<api-key>

SDK config: new ExpressMiddleware({ apiKey: process.env.ASTRASYNC_KEY, ... }). The Express and Next.js adapters auto-wire this.

Caller metadata forwarding

When the SDK runs inside a counterparty server, the backend otherwise sees the counterparty server's own IP/UA — useless for endpoint-owner forensics. The Express and Next.js adapters auto-forward the agent-side fingerprint:

{
  "callerMetadata": {
    "sourceIp": "203.0.113.42",           // First X-Forwarded-For hop or req.ip
    "userAgent": "Mozilla/5.0 (…)",
    "referer": "https://example.com/…",
    "host": "api.yourservice.com",
    "forwardedFor": "203.0.113.42, 10.0.0.1",
    "agentCardUrl": "https://agent.example.com/.well-known/agent-card.json"
  }
}

Probe access — AstraSync-Probe/1.0

AstraSync reserves the User-Agent string AstraSync-Probe/1.0 for future endpoint health-checks and webhook-delivery validation. The probe is opt-in — nothing fires today — but if you operate a WAF, security gateway, or restrictive robots.txt, allow this UA on the paths you registered with AstraSync. Match-by-prefix (AstraSync-Probe/) so future versions don't need a config change.

# robots.txt
User-agent: AstraSync-Probe/1.0
Allow: /
Crawl-delay: 5

See https://astrasync.ai/robots.txt for the canonical declaration on our own surface.