wayid-nginx checks the WayID of inbound AI agents at the NGINX edge, before a request reaches your application. It is part of the WayID verification SDK and covers the case where you want identification at the reverse proxy rather than inside your app code.
An agent declares itself with a WayID: wayid:agent:{24-char-base58} request header (full DID or the bare tail). An njs handler wired with js_content reads the header, resolves it against {issuer}/api/v1/agent/{did}, and forwards the outcome to your upstream as X-WayID-Decision, X-WayID-Verified, X-WayID-DID, X-WayID-Identity-Level, and X-WayID-Status headers before an internalRedirect. With $wayid_enforce on, a deny decision returns 403 instead.
The v1 design is passive: the header is self-asserted, so this is identification rather than authentication. Cryptographic proof-of-possession based on Web Bot Auth (RFC 9421) is a planned v2 layer. The handler uses js_content instead of auth_request because njs's ngx.fetch does not run inside an auth_request subrequest.
Features
- Fails open: a missing, unknown, or malformed header, or an issuer outage, never blocks traffic unless enforcement is switched on
- Resolution cache: results are cached in a js_shared_dict_zone for the zone TTL so the issuer is not called on every request
- Configuration variables: $wayid_issuer (default https://way.je), $wayid_enforce, and $wayid_require_verified to require an owner identityLevel of verified
- No crypto, no sidecar: the passive handler runs inside NGINX with the njs module and no separate process
- Sample config: conf/wayid.conf provides a server {} template with the gate location and an internal upstream location
- Integration test: test/run.sh runs the handler in real NGINX + njs under Docker against a mock issuer and asserts allow, deny, and flag behavior
- auth_request alternative: for NGINX builds without njs, the @lineagelabs/wayid-verify package can run as a small sidecar service behind auth_request