SharkAuth

Auth infrastructure for the agentic era

Open Source

Developer Tools

Artificial Intelligence

GitHub

Visit WebsiteSee on Product HuntGithub ⧉Twitter ⧉

Hello Product Hunt I’m Raúl, the creator of SharkAuth. I built SharkAuth because I think authentication is about to change. Most auth systems were designed for a simple world: user → app → API But AI agents create a different world: user → agent → sub-agent → tool → API And that changes the security model. Every day we see more stories of agents deleting production data, leaking keys, taking actions they were not supposed to take, or becoming hard to trace once they start calling tools and APIs across a system. The problem is: if you want users in your app, you can use Auth0, Clerk, Stack Auth, or another auth provider. But if you want to secure agents acting on behalf of users, you usually have to handroll the primitives yourself: Who delegated access? To which agent? For what scope? For how long? Which downstream actions came from that delegation? Can the entire chain be revoked instantly? That’s the problem SharkAuth is trying to solve. SharkAuth is an open-source OAuth server built around agent delegation primitives: • RFC 8693 Token Exchange • RFC 9449 DPoP-bound agent access • revocable may_act grants • delegation chains • cascade revocation • grant_id audit trails • embedded dashboard • SQLite by default • one Go 29MB binary Today, SharkAuth makes an agent’s access path DPoP-bound, scoped, auditable, and revocable. The longer-term vault direction is to broker external OAuth tokens behind this model, so agents can use services like Google or GitHub without directly handling upstream bearer tokens. The demo shows the core primitive: An agent receives delegated authority. A downstream access path is created. We revoke the grant. The chain dies. It’s early, open source, and still evolving, but I think this problem is going to matter a lot as agents move from demos into real systems. I’d love feedback from people building agents, auth systems, devtools, infra, or security products. Especially curious: How are you handling delegated agent access today? And what would you want to see in an authentication provider built specifically for agents?