Your identity and content are rented back to you by the platforms that own it. The DFOS Protocol gives you back the keys.
An open protocol for cryptographic identity and verifiable content. Identity derives from Ed25519 signed operations, not platform accounts. Proofs verify offline, in any language, from any source. The proof is public; the content is access-controlled. The protocol commits to content hashes, never plaintext — it does not encrypt, and document confidentiality is enforced at the application layer (the relay operator that serves a space can read it; there is no end-to-end encryption).
The first thing it cleanly solves: a portable, rotation-capable signing identity for AI agents and devices — a did:dfos derives from a genesis operation and needs no external directory to resolve.
This repository contains the protocol specification, reference implementations in TypeScript and Go, cross-language verification suites, and the CLI.
| Package | Language | Description |
|---|---|---|
@metalabel/dfos-protocol |
TypeScript | Ed25519 signed chain primitives, services, credentials, and verification |
dfos-protocol-go |
Go | Go protocol library — signing, verification, CID derivation, credentials |
@metalabel/dfos-web-relay |
TypeScript | Portable HTTP relay — Hono app, any runtime |
@metalabel/dfos-client |
TypeScript | High-level read client — resolve + verify orchestration over relays |
dfos-web-relay-go |
Go | Go relay — single binary, SQLite, built-in peering |
dfos-cli |
Go | The sovereign actor — keys, signing, relay interaction |
protocol-verify |
TS/Go/Py/Rust/Swift | Cross-language verification against shared test vectors |
relay-conformance |
Go | Integration tests against any live relay |
site-protocol |
Astro | Static site for protocol.dfos.com |
site-schemas |
Hono | Worker for schemas.dfos.com |
dfos-explorer |
TypeScript | Client-side chain explorer at explore.dfos.com — re-verifies untrusted relays in the tab |
siwd-demo |
TypeScript | Complete Sign In With DFOS relying party — live at dfos-siwd-demo.vercel.app |
- Set up Sign In With DFOS — task-oriented guide to adding DFOS sign-in to your app; the specs below are the normative layer
- Protocol specification — core protocol with worked examples and test vectors
- DID Method — W3C DID method specification for
did:dfos - Content Model — standard JSON Schema content types
- Credentials — UCAN-style authorization, linear delegation, revocation
- Credits — verifiable attribution: signed credit claims bound to the content they credit
- Sign In With DFOS — cryptographic identity verification for third-party applications
- Signing — transport-agnostic requests for DFOS signatures
- API Authentication — proof-of-possession authentication for credential-gated HTTP APIs
- Origin Binding — bidirectional binding between a
did:dfosand a web domain - Relay Contract — the frozen relay wire surface: routes, shapes, pagination
- Web Relay — reference relay behavior: ingestion, peering, and the content plane
- Extension Registry — the index of registered service types and JWS
typvalues - Threat Model — adversary classes and the trustless-proof / honest-host split
- Conformance — tiered conformance definition and self-certification
- JSON Schemas — hosted schema definitions for DFOS documents
Each spec declares its own clock in its header; this table is the index, not the authority.
| Spec | Clock / status |
|---|---|
| PROTOCOL | v1 — frozen, not yet final |
| RELAY-CONTRACT | Frozen with v1 — the relay wire surface |
| WEB-RELAY | Reference relay behavior, own 0.x clock |
| DID-METHOD | v1 — frozen |
| CREDENTIALS | v1 — frozen |
| CONTENT-MODEL | Encoding rule frozen with v1; schema vocabulary on its own 0.x |
| CREDITS | Settled — additive capability on v1 |
| SIGNING | 0.1 — optional capability, own 0.x clock |
| SIWD | 0.1 — optional authentication seam, own 0.x clock |
| API-AUTH | 0.1 — optional capability, own 0.x clock |
| ORIGIN-BINDING | 0.1 — optional capability, own 0.x clock |
| KEY-PROOF | Envelope shares the protocol's v1 clock; ceremony on its own 0.x |
| EXTENSIONS | Companion — indexes registered names, defines no rules |
| THREAT-MODEL | Companion — assembles specified surface, defines no rules |
| CONFORMANCE | Companion — tiers over the normative MUST sets, defines no rules |
- Chain verifier — browser-based chain verification tool
- Chain explorer — client-side, verify-in-tab
- DFOS app — the platform
- npm packages —
@metalabel/dfos-protocol,@metalabel/dfos-web-relay,@metalabel/dfos-client @metalabel/dfos-api— typed TypeScript SDK for api.dfos.com, generated from the live OpenAPI spec (separate repository)- DFOS — the builder and cryptography space
- dfos.com