Agentication: Turning Session Based APIs Into OAuth APIs Programatically

I believe OAuth is the only solution to delegated authorization for agents that works well today. However, there is an extremely short list of services today that support OAuth. Therefore, in order to increase the secure capabilities of agents, it is important to increase the number of OAuth APIs. That’s what Agentication tries to do. From the developer’s perspective, they can build client applications on top of LinkedIn/X/JetBlue, for example, as if the real backend APIs were OAuth.

Notes on implementation:
The system consists of two main components: a central proxy server and client libraries. The proxy server acts as a secure intermediary, maintaining authenticated sessions with various services while exposing a standardized OAuth 2.0 authorization interface. Clients authenticate using a lightweight OAuth flow where they receive tokens scoped to specific hosts and permissions. When making API requests, clients include these tokens, allowing the proxy to validate their authorization before enriching the requests with the necessary session credentials. This architecture enables secure API access delegation without exposing sensitive session data, while the proxy handles all the complexity of maintaining sessions, managing cookies, and dealing with service-specific authentication requirements. The client library provides a simple interface for authorization and making proxied requests, abstracting away the underlying OAuth and HTTP mechanics.