Decentralized Identity (DID) and Verifiable Credentials management for AI Agents
Decentralized Identity (DID) and Verifiable Credentials management system for AI Agents, built on W3C DID Core and W3C Verifiable Credentials standards.
Identity Trust provides a complete solution for decentralized identity management, enabling AI agents to:
Option A: Via npm (Recommended)
# Install globally for CLI access
npm install -g openclaw-identity-trust
# Verify installation
identity-trust --version
Option B: From GitHub
# Clone repository
git clone https://github.com/ZhenRobotics/openclaw-identity-trust.git
cd openclaw-identity-trust
# Install dependencies
npm install
# Build
npm run build
# Check CLI is working
identity-trust info
# Create your first DID
identity-trust did create
AUTO-TRIGGER when user's message contains:
DID, verifiable credential, identity, trust, decentralized identityTRIGGER EXAMPLES:
DO NOT USE when:
~/.openclaw/identity/This skill provides 6 core tools for AI agents:
did_create - Create Decentralized IdentifiersCreate a new DID for an agent or entity.
Parameters:
method (string, optional): DID method - key, web, or ethr (default: key)keyType (string, optional): Cryptographic key type - Ed25519 or secp256k1 (default: Ed25519)save (boolean, optional): Save to local storage (default: true)Returns:
did (string): The generated DID identifierdocument (object): Complete DID DocumentExample:
identity-trust did create --method key --key-type Ed25519
did_resolve - Resolve DIDs to DocumentsResolve a DID to its DID Document.
Parameters:
did (string, required): DID to resolve (e.g., did:key:z6Mkf...)Returns:
document (object): DID Document with verification methodsExample:
identity-trust did resolve did:key:z6MkfzZZD5gxQ...
vc_issue - Issue Verifiable CredentialsIssue a W3C-compliant verifiable credential.
Parameters:
issuerDid (string, required): Issuer's DIDsubjectDid (string, required): Subject's DIDclaims (object, required): Claims to include in credentialtype (string, optional): Credential type (default: VerifiableCredential)expirationDays (number, optional): Expiration in daysReturns:
credential (object): Signed verifiable credentialExample:
identity-trust vc issue \
--issuer did:key:z6Mkf... \
--subject did:key:z6Mkp... \
--claims '{"role":"developer","level":"senior"}' \
--expiration 90
vc_verify - Verify CredentialsVerify the authenticity and validity of a verifiable credential.
Parameters:
credential (object, required): Credential to verifycheckExpiration (boolean, optional): Check expiration date (default: true)Returns:
verified (boolean): Whether credential is validchecks (object): Detailed verification resultsExample:
identity-trust vc verify <credential-id>
identity_list - List IdentitiesList all stored DIDs and credentials.
Parameters: None
Returns:
dids (array): List of stored DIDscredentials (array): List of stored credentialsExample:
identity-trust did list
identity-trust vc list
trust_evaluate - Evaluate Agent TrustEvaluate the trust level of an agent based on their credentials and policy.
Parameters:
agentDid (string, required): Agent DID to evaluatepolicy (object, optional): Trust policy configurationReturns:
trustLevel (number): Trust score (0-100)credentials (array): Credentials used for evaluationpassed (boolean): Whether agent meets policy requirementsExample:
# Programmatic usage
import { evaluateTrust } from 'openclaw-identity-trust';
const result = await evaluateTrust('did:key:z6Mkf...', {
minimumTrustLevel: 60,
requiredCredentials: ['IdentityCredential'],
trustedIssuers: ['did:key:authority...']
});
Three command aliases available:
openclaw-identity-trustidentity-trustidt# Create a new DID
identity-trust did create [--method <key|web|ethr>] [--key-type <Ed25519|secp256k1>]
# Resolve a DID
identity-trust did resolve <did>
# List all DIDs
identity-trust did list
# Issue a credential
identity-trust vc issue \
--issuer <did> \
--subject <did> \
--claims '<json>' \
[--type <type>] \
[--expiration <days>]
# Verify a credential
identity-trust vc verify <credential-id-or-json>
# List credentials
identity-trust vc list [--subject <did>]
# Export all data
identity-trust export
# Show system information
identity-trust info
Use as a Node.js library in your applications:
import {
generateDID,
resolveDID,
issueCredential,
verifyCredential,
LocalStorage
} from 'openclaw-identity-trust';
// Initialize storage
const storage = new LocalStorage();
await storage.initialize();
// Create a DID
const { did, document, keyPair } = await generateDID('key', {
keyType: 'Ed25519'
});
console.log('Created DID:', did);
// Issue a credential
const credential = await issueCredential({
issuerDid: 'did:key:issuer...',
issuerKeyPair: keyPair,
subjectDid: did,
claims: {
role: 'ai-agent',
capabilities: ['read', 'write', 'execute']
},
expirationDate: new Date(Date.now() + 90 * 24 * 60 * 60 * 1000)
});
// Verify credential
const result = await verifyCredential(credential, {
checkExpiration: true,
localStore: storage.getDIDStore()
});
console.log('Verified:', result.verified);
Create persistent identities for AI agents:
# Create agent DID
identity-trust did create --method key
# Issue capability credential
identity-trust vc issue \
--issuer did:key:authority... \
--subject did:key:agent... \
--claims '{"agent":"GPT-Agent-001","capabilities":["api_access","data_read"]}'
Authenticate agents accessing services:
const credential = await storage.getCredential(credentialId);
const result = await verifyCredential(credential);
if (result.verified) {
// Grant access to service
console.log('Access granted');
} else {
console.log('Access denied:', result.error);
}
Build trust relationships between agents:
const trust = await evaluateTrust(agentDid, {
minimumTrustLevel: 60,
requiredCredentials: ['IdentityCredential', 'CapabilityCredential'],
trustedIssuers: [authorityDid],
allowExpired: false
});
if (trust.passed) {
console.log(`Agent trusted with level: ${trust.trustLevel}%`);
}
This implementation follows:
~/.openclaw/identity/Default: ~/.openclaw/identity/
Structure:
~/.openclaw/identity/
├── dids.json # Stored DID documents
├── credentials.json # Issued/received credentials
└── keys.json # Encrypted private keys
# Optional: Custom storage path
OPENCLAW_IDENTITY_PATH=/custom/path
# For did:web resolution (if using network)
OPENCLAW_IDENTITY_NETWORK_ENABLED=true
| Feature | Identity Trust | Traditional Auth | OAuth/SAML |
|---|---|---|---|
| Decentralized | ✅ | ❌ | ❌ |
| Self-sovereign | ✅ | ❌ | ❌ |
| W3C Standards | ✅ | ❌ | ❌ |
| No Central Authority | ✅ | ❌ | ❌ |
| Cryptographic Proofs | ✅ | 🟡 | 🟡 |
| Agent-to-Agent | ✅ | ❌ | 🟡 |
| Offline Verification | ✅ | ❌ | ❌ |
Problem: Error: Private key not found
# Solution: Ensure DID was saved when created
identity-trust did create --save
Problem: Error: Failed to resolve DID
# Solution: Check DID format and network settings
identity-trust did resolve did:key:z6Mkf...
Problem: Error: Signature verification failed
# Solution: Check issuer DID and credential integrity
identity-trust vc verify --no-expiration <credential>
Initial release with:
Contributions welcome! Please:
MIT License - see LICENSE
Built with ❤️ for the OpenClaw ecosystem
ZIP package — ready to use