Identity · Token delegation · On your behalf

Your agent acts.
You stay in control.

nominee hands your agent a fresh third-party token at the exact moment of a tool call — pauses for human approval when it matters, and records who authorized what. Provider-neutral. No signup to start.

Read the docs →

Works standalone, with the Vercel AI SDK, Eve, and Cloudflare Agents.

No signup by defaultBring a function, env var, DB lookup, or OAuth refresh. Auth0 is optional.

Zero deps in coreProvider and framework code lives in optional adapter packages.

Made for durable runsAsk for a token at call time — never hand a paused agent a stale one.

Install and go

Six lines. No service to sign up for.

Give nominee a way to get a token. It handles freshness, approval, and audit on top.

defaultai sdkauth0agent.ts

import { Nominee } from 'nominee'

// the whole setup — a function that returns a token
const nominee = new Nominee({
  strategy: ({ connection }) => process.env[`${connection.toUpperCase()}_TOKEN`]!,
})

// at tool-call time — always fresh, cached until just before expiry
const token = await nominee.token({ user: 'alice', connection: 'github' })

Packages

One auth layer, wherever your agent runs.

Core

nominee

Engine, strategies, token cache, approvals, audit stream. Zero runtime deps.

npm i nominee Vercel AI SDK

nominee-ai

Fresh tokens and approval gates inside AI SDK tools. Runs on Cloudflare Agents too.

npm i nominee nominee-ai Vercel Eve

nominee-eve

Wrap Eve tools with nominee token injection and human-in-the-loop approval.

npm i nominee nominee-eve Optional · Managed

nominee-auth0

Auth0 Token Vault for federated tokens, and CIBA approvals on the user's phone.

npm i nominee nominee-auth0

Human in the loop

Hold the risky actions until a person says yes.

Gate deletes, payments, or outbound mail. Use the built-in approval engine, or a native flow like Auth0 CIBA that pings the user's phone — the agent pauses without burning compute, then resumes.

Awaiting approval

repo.delete

Delete repository alice/old-project

DenyApprove

user → triage-bot → github · logged to audit