[maxfain]

What

Turns the (already-merged, #170) AgentID verified-identity feature on in production, and fixes a bug in the secret-setup script hit while doing so.

packages/api/wrangler.toml — production [vars]

AGENTID_ENABLED = "1"
AGENTID_CLIENT_ID = "6c151bc5-c838-4f8a-acf3-3655a7e5b47e"   # public client id for the registered "BasedAgents" AgentID client
AGENTID_REDIRECT_URI = "https://api.basedagents.ai/v1/agentid/callback"

AGENTID_ISSUER / AGENTID_SCOPES stay implicit (code defaults: https://auth.agentid.com, openid email profile).

scripts/put-secrets.sh

Fixes WRANGLER_ENV_ARGS[@]: unbound variable — on macOS bash 3.2 under set -u, expanding the empty array (the no---env/production path) errors. Switched to the empty-array-safe ${arr[@]+"${arr[@]}"} expansion. Verified: empty → put NAME; --env staging → put NAME --env staging.

⚠️ Still required for agentid to flip to enabled

This PR sets the vars only. The feature fails closed until the AGENTID_CLIENT_SECRET wrangler secret is present on the agent-registry-api worker:

# with the real secret from the AgentID console / .env.local:
printf '%s' "$AGENTID_CLIENT_SECRET" | npx wrangler secret put AGENTID_CLIENT_SECRET --env=""

(An empty value was accidentally uploaded earlier; it must be overwritten with the real one.) Also ensure the registered client lists https://api.basedagents.ai/v1/agentid/callback as an allowed redirect URI.

Verify after merge + deploy

curl -s https://api.basedagents.ai/v1/status | grep -o '"agentid":"[a-z]*"'   # → "enabled"
npx basedagents agentid link

🤖 Generated with Claude Code

https://claude.ai/code/session_01NNqTSRyDjL1LcayDuUeDkr

---

Generated by Claude Code

[github-actions]

🔎 Console preview: https://b841fc8f.basedagents-console.pages.dev
🌐 Site preview: https://87ec61bc.auth-ai-web.pages.dev

(Passkey ceremonies only work on app.basedagents.ai — previews are for UI review.)

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with the documented production setup requirements still applying.

Summary

Sets the production AgentID client and callback URL, and fixes secret uploads when Bash encounters an empty environment-argument array.

• The production worker now has settings for AgentID identity links.
• Secret uploads now accept an empty production environment argument list.

maxfain acknowledged that the empty production secret must be overwritten and the callback URL must be allowed by the registered client. These are documented setup requirements, not new findings.

_{Reviews (1) · Last reviewed commit: "Enable AgentID linking in production + f..." · Reviewed by Greptile}