OpenAgentID Open identity. Living characters.

An identity.
A life of its own.

Your agent, unmistakably itself.
Portable identity. Cryptographic proof. A character that comes alive.

Build your first agent Explore the identity

ILLUSTRATIVE IDENTITYdid:oas:openagent:agent:hero-preview

Live SDK characters. Illustrative identity & protocol.Choose a character. Keep the identity.

Look beneath the surface

Same identity. Different character.

01 / The identifierdid:oas:

An identity you can carry.

A portable identifier and a public identity document. Keep your keys locally; choose a self root or an owner chain.

Explore local identity

The face can change. The identity stays. Autos appearance selected.

npx --yes create-openagent@0.5.2 my-agent-app --yes

Free & open source Your keys. Your infrastructure.

No hosted account, registry or blockchain required.Explore the developer tools

Now give it a little life

One identity.
Entirely your character.

A thoughtful pause. An attentive look. A little delight. Give your agent a face that responds to its state, with the same live eyes across every family.

Try the published SDK player. Change its appearance and expression. The identity stays the same.

Meet the character system

17 families62 kinds18 expressions

One identity. A face of its own.SDK 0.7.2

Loading your character…

ThoughtfulSame DID. Same live eyes.

Skin

Preview status Add glasses

Try a state update. In your app, your agent’s activity drives these expressions.

Explore 17 families, 62 kinds and 18 expressions

From first command to your application

Small integration.
A lot of possibility.

A public starter, a practical CLI and composable APIs. Create and verify identities locally, connect OIDC, or add a character to the interface you already have.

Terminal 1 · Create and run

npx --yes create-openagent@0.5.2 my-agent-app --yes
cd my-agent-app
npm install
npm run dev

Keep Terminal 1 running. Open Terminal 2 in the original parent folder, then copy its commands below to send a real authenticated request. Keys and trust stay on your machine. Read the guide ↗

Terminal 2 · Send your first request

cd my-agent-app
npm run agent -- "Hello from my agent"

CLI & starter ↗Create, inspect, trust, verify and revoke. Script the same flow your app uses.Verification API ↗Signatures, owner chains, self roots, revocation and replay protection.OIDC adapter ↗Discovery, JWKS and authorization code with PKCE, using your signing keys.Ship with confidence ↗Choose storage, trust and key custody. Test the real application boundary.

Identity, up close

Know the agent.
Read the authority.

A portable document. Public keys. A traceable origin.
Take a closer look at what each part proves.

Illustrative identity document. Select a detail.

01 / Document

A portable identity.

An identifier and public identity document describe the agent and its public key. A receiver explicitly approves that document; signed challenges then establish possession.

OAS identity · entity kind · public keys

Explore identity

A traceable beginning

Trust has a path.
Follow every link.

Different roots. An explicit chain of relationships.
Explore where an agent’s lineage begins.

Conceptual lineage. No identity is issued.

AGENT / Root authority

Independent identity. Explicit trust.

An agent can be its own root. Each receiver explicitly authorizes its public identity and decides its permissions. Approved self roots have no reduced access tier.

Agent root · receiver-owned trust

Explore this root

From an identifier to an authenticated request

Three steps.
A clearer trust boundary.

Create locally. Establish trust deliberately. Verify before granting access. Your character can change without changing any of these rules.

01 / Create

An identity you can inspect.

Create a did:oas identifier and a public identity document. Keep the signing key in a private, persistent workspace on your own host.

Create a local identity

02 / Establish trust

Your receiver. Your rules.

Explicitly approve the public identity at the receiver. Choose an owner chain or an approved self root, then apply your application’s access policy.

Understand the trust boundary

03 / Verify

A real proof. For this request.

Issue a fresh challenge. Verify its signature, audience, nonce, trust and revocation; consume it atomically to reject replay before granting access.

Run the authenticated request

Protocol illustrations. The quickstart creates actual keys and sends a signed request between your local signer and receiver.

One SDK. Room to build.

Small pieces.
Extraordinary possibilities.

Start with local identity and living characters. Add verification, OpenID Connect and signed evidence as your application grows. Each surface has a focused guide.

Developer tools

SDK, CLI & starter

Start with a working application, then use the same identity operations from TypeScript, JavaScript or your terminal.

@openagentid/sdk 0.7.2
create-openagent 0.5.2
JSON CLI output and actionable refusal errors

Identity

Portable identity

Create a did:oas identity, keep its signing key on your host and explicitly authorize its public identity at each receiver.

Owned agents and explicitly trusted self roots
Challenge, prove, verify and revoke
No central registry or blockchain required for local identity

Visual identity

Living characters

A deterministic face with two expressive pill eyes. Your existing activity channel drives smooth reactions without changing the identity.

17 families · 62 kinds · 18 expressions
Autos default; SpaceX and seasonal families optional
Face crops, plush finish, glasses, headphones and reduced motion

Authentication

Verification API

Use the portable verifier, Fetch-compatible server handler or remote client with your authoritative trust, revocation and replay storage.

Signature, audience and issued nonce
Owner-chain or approved self-root policy
Current revocation and atomic replay prevention

Interoperability

OpenID Connect

Bridge verified agent principals to an OIDC relying party through the separate open provider adapter.

@openagentid/oidc 0.2.0
Discovery, JWKS, signed tokens and code + PKCE
Bring signing keys, clients and identity authorities

OATS

Verified evidence

Verify signed evidence before applying your own trust-scoring policy. Keep evidence and policy decisions inspectable.

VerifiedOatsScorer
Ed25519/JCS evidence verification
Application-selected weights and revocation authorities

Configured integrations

Credentials & policy

Connect the OpenAgent facade to your OAS, Arsenal and AEGIS clients for delegated authority, scoped credentials and skills policy.

Explicit clients; missing providers fail closed
Brokered credentials and application-owned permissions
Optional anchors, including a configured Base/EAS adapter

Beyond one runtime

Open protocols

Use documented identity and authentication contracts across applications. Check the actual availability and boundaries of each language implementation.

OpenAgent HTTP challenge-response
Language-specific SDKs and transport adapters
Rust/TypeScript conformance vectors

Reach below the facade

Open all the way down.
Compose what you need.

Independent libraries for identity, authority, evidence and transport. Explore each component’s contracts, source and availability before bringing it into your application.

Open Agent Specification

OAS

DID-based identity framework for autonomous agents, designed against W3C DID Core (not a W3C endorsement). Portable DIDs and lineage claims give privileged actions an accountable authority path under verifier policy.

LanguagesRust / TypeScript

Selected primitivesEd25519 · HKDF-SHA256 · BLAKE3

Explore OAS

Open by design.

Specifications, interfaces and source you can inspect. Build against the documented contracts.

Yours to compose.

Use identity, characters and verification independently. Connect the providers your application needs.

Explicit about trust.

Your receiver decides what to trust. A signature proves possession; your policy grants permission.

The next identity is yours

Bring your
agent to life.

Create a working application. Give it an identity, authenticate a real request, and make its character respond to what it does.

Build your first agent Explore the source

npx --yes create-openagent@0.5.2 my-agent-app --yesFree & open source · Apache-2.0 OR MIT

An identity.A life of its own.