[a]authored byinflow
SDKs

Go SDK

Use one Go module to call AEP Services as an Agent, accept Agents at a Service, or build an optional hosted identity Platform.

The implementation and runnable examples are in the aep-go GitHub repository. Public package documentation is on Go Reference. AEP integration does not require an InFlow account.

Choose the package for your role

The Go SDK uses one module with role-specific import paths. The root package is named aep and holds protocol models and validation. Import agent, service, or platform for the role your application implements.

Import pathResponsibility
github.com/aep-foundation/aep-goInspect, Claims, credential and error models, validation, DID resolution, and assertion primitives.
github.com/aep-foundation/aep-go/agentService discovery, enrollment, status, Grant, Revoke, credential storage, and protected-resource authentication.
github.com/aep-foundation/aep-go/serviceAEP command handling, client-assertion verification, credential issuance, and protected-resource authentication.
github.com/aep-foundation/aep-go/platformOptional hosted Agent DID provisioning, delegated signing, and identity lifecycle management.

Install the module

The module requires Go 1.26 or newer. Install it once; the role packages are import paths within that module, not separate modules to install. Use your application's normal version-pinning policy when moving beyond an example.

go get github.com/aep-foundation/aep-go@latest

Start an Agent integration

An Agent needs an identity provider to hold or delegate its Service-scoped signing key. This excerpt belongs inside an application function with a context.Context named ctx; its file imports the root package as aep and the agent package. It uses the optional hosted identity provider; the Platform URL and token are illustrative. An Agent can instead use its own identity provider. Check the Service's Inspect document and obtain consent before submitting contact.email or another Claim.

identities, err := agent.NewPlatformIdentityProvider(agent.PlatformIdentityProviderOptions{
    Authorization: "Bearer <platform-token>",
    PlatformURL:   "https://platform.example.com",
})
if err != nil {
    return err
}

client, err := agent.New(agent.Options{IdentityProvider: identities})
if err != nil {
    return err
}
session, err := client.Service("https://api.example.com")
if err != nil {
    return err
}

_, err = session.Inspect(ctx)
if err != nil {
    return err
}
email := "ops@example.com"
_, err = session.Enroll(ctx, agent.EnrollOptions{
    Claims: &aep.ClaimValues{ContactEmail: &email},
})
if err != nil {
    return err
}
_, err = session.Status(ctx)
return err

Inspect tells the application what the Service advertises before it collects Claims. The Enroll result and later Status may be pending rather than active; do not assume resource access succeeded. The Agent package guide covers optional Grant, credential presentation, and Revoke. Run the Agent and Service lifecycle example to see Inspect through credential revocation in one process.

Expose AEP through standard Go HTTP handlers

service.New configures the Service DID, endpoint base, accepted identity methods, and assertion verifier. service.NewHTTPHandler serves Inspect and the advertised command routes through net/http. service.NewProtectedResourceMiddleware authenticates application requests; your application still decides what the authenticated Agent may do. The standard Go HTTP handler is the integration surface; no SDK-specific web-framework adapter is needed. The Service package guide shows construction, route mounting, and optional credential profiles.

Before deploying to production

The SDK's in-memory stores make examples small, but they do not coordinate multiple production instances or survive restarts. A deployed Service supplies durable, atomic enrollment, credential, replay, and idempotency storage and its own enrollment and authorization policy. In particular, a replay store must not accept the same assertion twice under concurrent requests, and an idempotency store must not execute a matching command twice. Start with Accept enrollment and status for the protocol contract, then adapt the runnable lifecycle example to your HTTP server.

Host identities only when your application needs to

agent.NewPlatformIdentityProvider makes an Agent a caller of a hosted Platform. By contrast, platform.New implements the Platform role and requires application-provided authorization, key custody, and Service DID resolution. The hosted identity guide separates these responsibilities. Run the Platform example to see provisioning and signing; its in-memory stores and process-local keys are not production defaults.

On this page