An njs-based request handler that lets NGINX identify inbound AI agents by their WayID before traffic reaches the application behind it. Agents self-declare identity via a WayID request header carrying a DID; the handler resolves that DID against the WayID issuer, then either forwards the decision to the upstream as X-WayID-* headers (decision, verified flag, DID, identity level, status) or returns a 403 when enforcement is switched on. Resolutions are cached in an njs shared dict so the edge does not call the issuer on every request.
The v1 design is deliberately passive: the header is self-asserted, no cryptography is involved, and the handler fails open — a missing, malformed, or unresolvable WayID never blocks traffic unless enforcement is explicitly enabled. The README frames this as identification rather than authentication, with cryptographic proof-of-possession (Web Bot Auth / RFC 9421) planned as a v2 layer. Behaviour is tuned through three nginx variables: the issuer origin, an enforce toggle, and an option to require a verified owner identity. Because njs's ngx.fetch cannot run inside an authrequest subrequest, the handler uses a jscontent-plus-internalRedirect pattern; for NGINX builds without njs, the project documents an alternative auth_request sidecar running the WayID verify JS package. An integration test runs the handler in real NGINX against a mock issuer.