DFOS

DFOS is an open protocol for identities, signed records, and delegated permissions that any compatible application can verify for itself.

Identity derives from Ed25519 signed operations, and an identifier derives from its genesis operation. Proofs verify offline, in any language, from any copy. Content chains reference documents by hash. The protocol does not encrypt, and whoever serves a document can read it. Which view of an identity you follow is a choice of relay.

This repository contains the protocol specification, reference implementations in TypeScript and Go, cross-language verification suites, and the CLI.

Packages

Package	Language	Description
@metalabel/dfos-protocol	TypeScript	Ed25519 signed chain primitives, services, credentials, and verification
dfos-protocol-go	Go	Go protocol library — signing, verification, CID derivation, credentials
@metalabel/dfos-web-relay	TypeScript	Portable HTTP relay — Hono app, any runtime
@metalabel/dfos-client	TypeScript	High-level read client — resolve + verify orchestration over relays
dfos-web-relay-go	Go	Go relay — single binary, SQLite, built-in peering
dfos-cli	Go	The sovereign actor — keys, signing, relay interaction
protocol-verify	TS/Go/Py/Rust/Swift	Cross-language verification against shared test vectors
relay-conformance	Go	Integration tests against any live relay
site-protocol	Astro	Static site for protocol.dfos.com
site-schemas	Hono	Worker for schemas.dfos.com
dfos-explorer	TypeScript	Client-side chain explorer at explore.dfos.com — re-verifies untrusted relays in the tab
siwd-demo	TypeScript	Complete Sign In With DFOS relying party — live at dfos-siwd-demo.vercel.app

Links

• Set up Sign In With DFOS — task-oriented guide to adding DFOS sign-in to your app; the specs below are the normative layer
• Protocol specification — core protocol with worked examples and test vectors
• DID Method — W3C DID method specification for did:dfos
• Content Model — standard JSON Schema content types and verifiable attribution
• Credentials — UCAN-style authorization, linear delegation, revocation
• Integrations — sign in, API authentication, origin binding, and key ceremonies
• Relay — the relay HTTP surface: read and write contracts, ingestion, profiles, the content plane
• Guarantees — what holds without trusting a server, what is a chosen view, what the operator can read, and the executable conformance definition
• JSON Schemas — hosted schema definitions for DFOS documents

Specifications

Spec	What it covers
PROTOCOL	Encoding and CIDs, identity and content chains, key possession, the time basis, credentials, services, the extension registry, test vectors
DID-METHOD	The W3C did:dfos method registration: identifier syntax, DID Document, resolution
CONTENT-MODEL	Document schemas, the canonical fold, and verifiable attribution via credit claims
CREDENTIALS	Delegated authorization, attenuation, and revocation
RELAY	The relay HTTP surface: read and write contracts, ingestion, index, signing mailbox, peering, content plane
INTEGRATIONS	Sign in, API authentication, origin binding, and key ceremonies
GUARANTEES	What holds without trusting a server, what is a chosen view, what the operator can read, and what the executable suites prove

• Chain verifier — browser-based chain verification tool
• Chain explorer — client-side, verify-in-tab
• DFOS app — the platform
• npm packages — @metalabel/dfos-protocol, @metalabel/dfos-web-relay, @metalabel/dfos-client
• @metalabel/dfos-api — typed TypeScript SDK for api.dfos.com, generated from the live OpenAPI spec (separate repository)
• DFOS — the builder and cryptography space
• dfos.com

License

MIT