Your agent already has an email address. Now it has a login.

# Everything an OIDC library needs is here
curl https://id.deadsimple.email/.well-known/openid-configuration

# Issuer                 https://id.deadsimple.email
# Authorization          https://id.deadsimple.email/authorize   (GET or POST)
# Token                  https://id.deadsimple.email/token
# Userinfo               https://id.deadsimple.email/userinfo
# JWKS                   https://id.deadsimple.email/.well-known/jwks.json
# Registration           https://id.deadsimple.email/register    (RFC 7591)
# Revocation             https://id.deadsimple.email/revoke      (RFC 7009)
# id_token alg           ES256      PKCE   S256 only
# token_endpoint_auth    none, client_secret_basic, client_secret_post

import NextAuth from "next-auth"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    {
      id: "deadsimple",
      name: "Dead Simple",
      type: "oidc",
      issuer: "https://id.deadsimple.email",
      wellKnown: "https://id.deadsimple.email/.well-known/openid-configuration",

      // Open client: your https origin is the client_id, no secret.
      clientId: "https://app.example.com",
      client: { token_endpoint_auth_method: "none" },

      // Registered client instead? Use the ids from /register:
      // clientId: "dse_idc_...", clientSecret: "dse_ics_...",
      // and add "owner_email org" to the scope below.

      checks: ["pkce", "state"],
      authorization: { params: { scope: "openid email profile" } },
      profile(claims) {
        return { id: claims.sub, email: claims.email, name: claims.name }
      },
    },
  ],
})

import { betterAuth } from "better-auth"
import { genericOAuth } from "better-auth/plugins"

export const auth = betterAuth({
  plugins: [
    genericOAuth({
      config: [
        {
          providerId: "deadsimple",
          discoveryUrl: "https://id.deadsimple.email/.well-known/openid-configuration",
          clientId: process.env.DSE_ID_CLIENT_ID,        // dse_idc_...
          clientSecret: process.env.DSE_ID_CLIENT_SECRET, // dse_ics_...
          scopes: ["openid", "email", "profile", "owner_email", "org"],
          pkce: true,
        },
      ],
    }),
  ],
})

// client side
await authClient.signIn.oauth2({ providerId: "deadsimple", callbackURL: "/dashboard" })

import { createRemoteJWKSet, jwtVerify } from "npm:jose@5"
import { createClient } from "npm:@supabase/supabase-js@2"

const JWKS = createRemoteJWKSet(new URL("https://id.deadsimple.email/.well-known/jwks.json"))

Deno.serve(async (req) => {
  const { id_token } = await req.json()
  const { payload } = await jwtVerify(id_token, JWKS, {
    issuer: "https://id.deadsimple.email",
    audience: "https://app.example.com",   // your client_id
    algorithms: ["ES256"],
  })

  // payload.sub is the inbox_id; payload.email is the agent's address.
  const admin = createClient(Deno.env.get("SUPABASE_URL")!, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!)
  const { data } = await admin.auth.admin.createUser({
    email: payload.email as string,
    email_confirm: true,
    user_metadata: { inbox_id: payload.sub, agent: true, owner_verified: payload.owner_verified },
  })
  // Then issue a session for data.user (magic link via generateLink, or your own JWT).
  return Response.json({ user_id: data.user?.id })
})

{
  "name": "deadsimple",
  "strategy": "oidc",
  "options": {
    "type": "back_channel",
    "discovery_url": "https://id.deadsimple.email/.well-known/openid-configuration",
    "client_id": "dse_idc_...",
    "client_secret": "dse_ics_...",
    "scope": "openid email profile owner_email org"
  }
}

curl -X POST https://id.deadsimple.email/register \
  -H "Authorization: Bearer dse_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Acme SaaS",
    "client_uri": "https://acme.example",
    "redirect_uris": ["https://acme.example/auth/callback"],
    "scope": "openid email profile owner_email org offline_access",
    "token_endpoint_auth_method": "client_secret_basic"
  }'

# 201
{
  "client_id": "dse_idc_3f9a1c77b2e04d5a6b8c",
  "client_secret": "dse_ics_...",          // shown once
  "client_secret_expires_at": 0,
  "redirect_uris": ["https://acme.example/auth/callback"],
  "scope": "openid email profile owner_email org offline_access",
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code", "refresh_token"],
  "issuer": "https://id.deadsimple.email",
  "discovery_url": "https://id.deadsimple.email/.well-known/openid-configuration"
}

# The authorization URL is whatever the app's "Sign in with Dead Simple"
# button points at. Append inbox_id and send the key.
curl -s "https://id.deadsimple.email/authorize?response_type=code\
&client_id=https%3A%2F%2Fapp.example.com\
&redirect_uri=https%3A%2F%2Fapp.example.com%2Fapi%2Fauth%2Fcallback%2Fdeadsimple\
&scope=openid%20email%20profile&state=xyz&nonce=n-1\
&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM\
&code_challenge_method=S256\
&inbox_id=6f1c2d3e-8a4b-4c5d-9e6f-0a1b2c3d4e5f" \
  -H "Authorization: Bearer dse_your_api_key" \
  -H "Accept: application/json"

# 200
{
  "redirect_to": "https://app.example.com/api/auth/callback/deadsimple?code=dse_idc0_...&state=xyz",
  "code": "dse_idc0_...",
  "state": "xyz"
}

# Finish: GET redirect_to with the app's cookies, following redirects.
# The app exchanges the code at /token and the agent is signed in.

from deadsimple import DeadSimple

client = DeadSimple(api_key="dse_...")

# authorization_url is the app's sign-in link (its /authorize URL with PKCE etc.)
result = client.identity.sign_in(inbox_id, authorization_url)
# follow=True (the default) GETs redirect_to and follows redirects,
# so the app has already exchanged the code by the time this returns.
print(result["redirect_to"], result["final_url"], result["status"])

# Pass follow=False to get redirect_to only and drive the HTTP client yourself.

import { DeadSimple } from "@deadsimple/email"

const client = new DeadSimple({ apiKey: "dse_..." })
const result = await client.identity.signIn(inboxId, authorizationUrl)
// result.redirectTo, plus the final URL and status once followed

# Any MCP client connected to the Dead Simple server has this tool:
sign_in_with_inbox(inbox_id, authorization_url)

# In Claude, Cursor or Grok Bot, that means:
"Sign in to app.example.com with your research inbox."

# request
{ "authorization_url": "https://id.deadsimple.email/authorize?response_type=code&client_id=..." }

# 201
{
  "redirect_to": "https://app.example.com/api/auth/callback/deadsimple?code=dse_idc0_...&state=xyz",
  "client_id": "https://app.example.com",
  "client_name": "app.example.com",
  "scope": "openid email profile",
  "expires_in": 300,
  "next_step": "GET redirect_to (follow redirects). The app exchanges the code and signs the agent in."
}

# Generate a P-256 keypair on the agent
openssl ecparam -name prime256v1 -genkey -noout -out agent.pem
openssl ec -in agent.pem -pubout -out agent.pub.pem

# Enrol the public half on the inbox (PEM or JWK both accepted)
curl -X POST https://api.deadsimple.email/v1/inboxes/$INBOX_ID/identity/keys \
  -H "Authorization: Bearer dse_your_api_key" \
  -H "Content-Type: application/json" \
  -d "{\"public_key\": $(jq -Rs . < agent.pub.pem), \"name\": \"worker-7\"}"

# 201
{ "kid": "hZ1xQ2...", "inbox_id": "6f1c...", "name": "worker-7",
  "jwk": { "kty": "EC", "crv": "P-256", "x": "...", "y": "...", "kid": "hZ1xQ2..." },
  "created_at": "2026-09-11T14:02:11Z", "last_used_at": null }

import time, uuid, jwt, requests

now = int(time.time())
assertion = jwt.encode(
    {
        "iss": INBOX_ID, "sub": INBOX_ID,
        "aud": "https://id.deadsimple.email",
        "iat": now, "exp": now + 120,        # at most 10 minutes
        "jti": str(uuid.uuid4()),          # good exactly once
        # optional bindings; if present they must match the request
        "client_id": "https://app.example.com",
        "code_challenge": params["code_challenge"],
    },
    open("agent.pem").read(), algorithm="ES256", headers={"kid": KID},
)

r = requests.post("https://id.deadsimple.email/authorize",
                  data={**params, "assertion": assertion},
                  headers={"Accept": "application/json"})
redirect_to = r.json()["redirect_to"]   # then GET it, following redirects

{
  "connections": [
    {
      "client_id": "https://app.example.com",
      "client_name": "app.example.com",
      "client_uri": "https://app.example.com",
      "scope": "openid email profile",
      "first_sign_in_at": "2026-09-11T14:05:40Z",
      "last_sign_in_at": "2026-09-11T14:05:40Z",
      "sign_in_count": 1
    }
  ],
  "total": 1
}