Skip to main content
This sample turns the verified Agent API login and Account/Info calls into a small browser application with a trusted Node.js backend.
The Agent API is Neuro’s primary HTTP API. Its name is unrelated to AI agents: the application acts through the Neuron’s Agent endpoint instead of connecting directly over XMPP and managing the corresponding private keys itself.

​
Architecture

The backend receives the JWT and immediately uses it for Account/Info. The browser receives only an allowlisted projection of the result.

​
1. Open the project

After cloning this documentation repository, change into the sample directory:
The project uses only Node.js built-ins. It does not require an install step or a package-manager lockfile.

​
2. Run the deterministic checks

With Node.js 20.6 or later:
The tests use a fake HTTP transport. They verify the signature input, Agent API URLs and bodies, bearer-token placement, browser allowlist, security headers, and generic upstream-error response without contacting a Neuron.

​
3. Configure a development Neuron

Copy the environment template:
Set these values in .env:
NEURON_HOST is a host with an optional port. Do not include https:// or a path. The .env file is ignored by Git.

​
4. Start the application

Open http://127.0.0.1:3000, then select Load safe account fields. Success shows the username and available account timestamps. The source email address, phone number, password, and JWT never enter the browser response.

​
Keep credentials on the backend

This sample deliberately:
  • binds only to 127.0.0.1;
  • rejects a host containing a scheme, path, or whitespace;
  • sends credentials only from the backend to the configured HTTPS Neuron;
  • returns Cache-Control: no-store for JSON;
  • applies a restrictive browser Content Security Policy;
  • returns a generic 502 response when the Neuron rejects or cannot complete the request.
It is not a production login system. Before deployment, add an application-user session, authorization checks, CSRF protection for state-changing routes, bounded timeouts and retries, rate limiting, secret management, and structured redacted logging.

​
Next