DFOS
DFOS is an open protocol for identities, signed records, and delegated permissions that any compatible application can verify for itself.
Identity derives from Ed25519 signed operations, and an identifier derives from its genesis operation. Proofs verify offline, in any language, from any copy. Content chains reference documents by hash. The protocol does not encrypt, and whoever serves a document can read it. Which view of an identity you follow is a choice of relay.
This repository contains the protocol specification, reference implementations in TypeScript and Go, cross-language verification suites, and the CLI.
Packages
| Package | Language | Description |
|---|
@metalabel/dfos-protocol | TypeScript | Ed25519 signed chain primitives, services, credentials, and verification |
dfos-protocol-go | Go | Go protocol library — signing, verification, CID derivation, credentials |
@metalabel/dfos-web-relay | TypeScript | Portable HTTP relay — Hono app, any runtime |
@metalabel/dfos-client | TypeScript | High-level read client — resolve + verify orchestration over relays |
dfos-web-relay-go | Go | Go relay — single binary, SQLite, built-in peering |
dfos-cli | Go | The sovereign actor — keys, signing, relay interaction |
protocol-verify | TS/Go/Py/Rust/Swift | Cross-language verification against shared test vectors |
relay-conformance | Go | Integration tests against any live relay |
site-protocol | Astro | Static site for protocol.dfos.com |
site-schemas | Hono | Worker for schemas.dfos.com |
dfos-explorer | TypeScript | Client-side chain explorer at explore.dfos.com — re-verifies untrusted relays in the tab |
siwd-demo | TypeScript | Complete Sign In With DFOS relying party — live at dfos-siwd-demo.vercel.app |
Links
- Set up Sign In With DFOS — task-oriented guide to adding DFOS sign-in to your app; the specs below are the normative layer
- Protocol specification — core protocol with worked examples and test vectors
- DID Method — W3C DID method specification for
did:dfos
- Content Model — standard JSON Schema content types and verifiable attribution
- Credentials — UCAN-style authorization, linear delegation, revocation
- Integrations — sign in, API authentication, origin binding, and key ceremonies
- Relay — the relay HTTP surface: read and write contracts, ingestion, profiles, the content plane
- Guarantees — what holds without trusting a server, what is a chosen view, what the operator can read, and the executable conformance definition
- JSON Schemas — hosted schema definitions for DFOS documents
Specifications
| Spec | What it covers |
|---|
| PROTOCOL | Encoding and CIDs, identity and content chains, key possession, the time basis, credentials, services, the extension registry, test vectors |
| DID-METHOD | The W3C did:dfos method registration: identifier syntax, DID Document, resolution |
| CONTENT-MODEL | Document schemas, the canonical fold, and verifiable attribution via credit claims |
| CREDENTIALS | Delegated authorization, attenuation, and revocation |
| RELAY | The relay HTTP surface: read and write contracts, ingestion, index, signing mailbox, peering, content plane |
| INTEGRATIONS | Sign in, API authentication, origin binding, and key ceremonies |
| GUARANTEES | What holds without trusting a server, what is a chosen view, what the operator can read, and what the executable suites prove |
License
MIT
