Build an agent.
Keep its identity.
Real keys, receiver-controlled trust and live avatars. Start a working application with public packages, then add portable verification, OIDC and verified OATS evidence where your product needs them.
Free and open · your keys, infrastructure and access policy
A working start.
A portable core.
Generate the receiver, signer and browser UI, or add only the module your existing application needs. The standalone path requires no Life account or hosted identity service.
npx --yes create-openagent@0.5.2 my-agent-app --yes
cd my-agent-app
npm install
npm run devA working local HTTP receiver, signer and live avatar UI.
npm package ↗create-openagent
A working local HTTP receiver, signer and live avatar UI.
Node 20+
Integration guide →@openagentid/sdk
Local custody, portable identity verification, CLI, OATS and deterministic avatars.
Node 20+ for local identity; browser ESM for live eyes
Integration guide →@openagentid/oidc
A configurable signing OIDC provider for registered relying parties.
Node 20.19+
Integration guide →1·After starting the generated application, run npm run agent in a second terminal. Its receiver verifies a real signed request and updates the local live eyes.
2·The local authority requires private persistent storage on one host. Hosted receivers choose their HTTPS transport, current trust policy and durable replay storage explicitly.
Identity first.
Authority explicit.
Approve a public identity at the receiver, verify its issued challenge, then authorize the operation. Presentation stays independent of that decision.
Identity on your host
Real Ed25519 keys, explicit receiver trust, durable single-use challenges and receiver-local revocation. No mandatory account or hosted authority.
Read the contract →Portable verification
Check signed possession and lineage, authoritative owned/self roots, key purposes, current revocation and atomic replay before admitting a request.
Read the contract →Live identity presentation
17 families, 62 kinds and 18 shared expressions. Autos defaults, face crops, plush/flat finish, raised eyes and optional glasses/headphones preserve the live timeline.
Read the contract →OIDC integration
Registered RP authorization code/PKCE, signed tokens and JWKS through a separately configured provider with current identity callbacks and durable storage.
Read the contract →Verified OATS evidence
Verify trusted attestation issuers, assertion keys, identity chains and credential revocation before scoring. A score grants no access.
Read the contract →CLI and working starter
Use the bundled oaid CLI or generate a real HTTP application. Explicit audience, key custody and receiver policy remain visible.
Read the contract →Small examples.
Real interfaces.
These modules use the published TypeScript package. Trust, current status and storage come from your application; endpoint strings and a valid-looking DID cannot supply them.
import { OpenAgentWorkspace } from '@openagentid/sdk/local';
const audience = 'urn:example:agent-requests';
const signer = await OpenAgentWorkspace.initialize('./signer-keys', { audience });
const receiver = await OpenAgentWorkspace.initialize('./receiver-trust', { audience });
const agent = await signer.createAgent('Research assistant');
// The receiving application's operator approves this public identity.
await receiver.trustIdentity(await signer.exportIdentity(agent.did));
const challenge = await receiver.issueChallenge(agent.did);
const proof = await signer.prove(agent.did, challenge);
const identity = await receiver.verify(proof, { nonce: challenge.nonce });
console.log(identity.did);
// Later: open the same directories; initialize never overwrites state.
// await receiver.revoke(agent.did); // Withdraw trust at this receiver.First run with two new private persistent directories. The receiver explicitly approves the public identity; the verified identity carries no application scopes.
Complete integration guide →Six language modules.
Distinct release tracks.
TypeScript and Python have public registry packages. Rust, Go, Swift and Kotlin also have source modules in the public SDK repository. Check each module's dependencies and API before choosing it.
The TypeScript local workspace and browser player are specific APIs; this catalog makes no blanket feature-parity claim.
| Module | Version / track | Distribution | Minimum runtime |
|---|---|---|---|
| TypeScript / JavaScript | 0.7.2 | Public registry | Node 20+ / browser ESM |
| Python | 0.1.0 | Public registry | Python 3.10+ |
| Rust | 0.1.0 source | Source checkout | Rust 1.78+ |
| Go | Source | Source checkout | Go 1.26.4+ |
| Swift | Source | Source checkout | Swift 6.0+ |
| Kotlin | 0.1.0 source | Source checkout | JDK 17+ |
npm install @openagentid/sdk@0.7.2Published on npm. The local identity and browser path uses public dependencies only; provider facade clients are separately configured.
Registry package ↗1·TypeScript — Published on npm. The local identity and browser path uses public dependencies only; provider facade clients are separately configured.
2·Python — Published on PyPI as openagentid-sdk; import openagent_sdk. Its ACT and protocol facade is a separate API from the TypeScript local workspace/browser player.
3·Rust — The unified openagent-sdk crate is source-only; crates.io currently has no package at that name. Component crates publish separately. This manifest's OAS/Arsenal/AEGIS Git dependencies can require additional repository access.
4·Go — Use sdks/go from the public SDK checkout. Its declared standalone module path is not available at the checked Go proxy endpoint; integrate the local module deliberately.
5·Swift — The Swift package manifest is at sdks/swift, not the repository root. Add that directory as a local Swift package from your checkout.
6·Kotlin — Use sdks/kotlin from the public checkout. The checked id.openagent:openagent-sdk Maven Central metadata endpoint has no release; a Gradle publication block is not publication evidence.
Registry metadata checked 12 October 2026: SDK 0.7.2 · Starter 0.5.2 · OIDC 0.2.0 · Python 0.1.0.
Reach the layer
you need.
Identity, authorization, credentials, fingerprints, glyphs, voice and attestation evidence remain separate contracts. The public starter does not require every integration package.
Your receiver.
Your trust policy.
Owned and explicitly authorized self-rooted agents are supported. A signature establishes possession; your application grants the operation and tenant access.
The SDK repository is public and licensed Apache-2.0 or MIT. Some optional integration dependencies have their own access requirements. Life offers hosted services around the free core; this catalog promises no certification, support SLA or hosted login.
Keep the identity portable, the authority explicit and the avatar alive.