News for hackers. Stuff that matters.

A comment on JWTs and OAuth suck for AI agents. Meet Wafers.

Re:JWTs and OAuth suck for AI agents. Meet Wafers by positiveblue on Tuesday September 02, 2025 @11:23AM (#45104263)
TLDR: JWTs say who you are. Wafers say who this request is on behalf of and exactly what it can do.
[ Parent | on HN ]
Re:JWTs and OAuth suck for AI agents. Meet Wafers by afiori on Tuesday September 02, 2025 @11:26AM (#45104314)
It looks very similar to Macaroons

https://news.ycombinator.com/item?id=39204314

https://news.ycombinator.com/item?id=43499783

https://news.ycombinator.com/item?id=25233311

What are the differences?

[ Parent | on HN ]
Re:JWTs and OAuth suck for AI agents. Meet Wafers by positiveblue on Tuesday September 02, 2025 @11:36AM (#45104479)
Wafers are definitely inspired by Macaroons, but the core difference is that delegation is tied to identity.

In Macaroons, anyone who holds the token can tack on caveats.

In Wafers, only the current holder can extend it, and they can explicitly name the next holder by public key.

That gives you a verifiable chain of custody instead of an unanchored blob.

[ Parent | on HN ]