Examples

aic-agent examples pair with the aic-verifier service examples — each one drives a service that aic-verifier itself hosts. Commands are exactly as documented in each example's header.

0. Setup

You need both SDKs checked out side by side:

git clone https://github.com/varwof/aic-verifier   # the service side
git clone https://github.com/varwof/aic-agent      # this SDK

1. call-bearer → bearer-jwt-backend

The client calls a Bearer-AIC-JWT-protected service (the bearer-jwt-backend example). The agent key is created on first run (agent-key.pem); the minted token is bound to that key via cnf.jkt and carries the api:read capability the service requires.

# terminal 1 — the service
( cd aic-verifier/examples/bearer-jwt-backend && go run ./gen-bearer && go run . )

# terminal 2 — the agent
go run . \
    --issuer aic-verifier-example --audience myapi --realm example --id agent-001 \
    --url https://localhost:9443/api

2. call-mtls → mtls-backend

The client presents an mTLS client certificate that carries the AIC X.509 extension (issued by gen-cert) to the mTLS-protected service:

# terminal 1 — the service
( cd aic-verifier/examples/mtls-backend && go run ./gen-cert --out dev-certs && go run . )

# terminal 2 — the agent
go run . \
    --cert aic-verifier/examples/mtls-backend/dev-certs/client-cert.pem \
    --key  aic-verifier/examples/mtls-backend/dev-certs/client-key.pem \
    --ca   aic-verifier/examples/mtls-backend/dev-certs/ca-cert.pem \
    --url  https://localhost:9444/api

Trusting the demo CA (--ca) also pins the server cert.

3. smoke-call → real PKI

Smoke-tests the SDK against a real varwof PKI: presents the AIC certificate issued by varwof core to an aic-verifier-protected service. This is the end-to-end check that issuance (ObtainAIC) and presentation both work against a non-demo CA.

What each one proves

Example	Proves
call-bearer	local mint, cnf.jkt binding, kid/SPKI trust, api:read capability admission, identity header injection
call-mtls	mTLS cert with AIC extension, chain verification, server CA pinning
smoke-call	real-PKI issuance → presentation round trip

See the aic-verifier side for the corresponding service examples and their assertion of the X-AIC-* identity headers: varwof/aic-verifier docs/examples.md.