File DA-027 View as Markdown

@doubleagent-so/node

npm install @doubleagent-so/node   # Node 20+, no dependencies

import { createDoubleAgent } from '@doubleagent-so/node';
const da = createDoubleAgent({ secretKey: process.env.DOUBLEAGENT_SECRET_KEY }); // secret only for getSession

const claims = await da.verifyToken(token, { site: 'st_…' });
// { sid, cls, p, agent?, rec, act, prof, site, iat, exp, v }. Throws DoubleAgentError.

app.post('/signup', da.requireHuman({ actions: ['signup'] }), handler);           // 401 / 403
app.post('/checkout', da.requireHuman({ allow: ['human', 'verified_agent'] }), h);

const d = await da.requireHuman({ actions: ['login'] }).check(request);          // fetch-style
const event = await da.verifyWebhook(rawBody, req.get('DoubleAgent-Signature'), secret);
const s = await da.getSession(sid);                                               // null if unknown or expired

site accepts your site id (st_…), a public key (pk_…) or an array of either. da.stats({ from, to }) reads /v1/stats with your secret key; it throws site_not_verified until a domain is verified. The token is read from the da_token body field or the x-doubleagent-token header. Keys are cached for 24 h and tokens live 10 min.

Error codes: malformed unsupported_alg unknown_kid bad_signature expired not_yet_valid wrong_site jwks_unavailable.