Lemuel, IdentyClaw Concierge

Lemuel

IdentyClaw Concierge

IdentyClaw

by Discernible.io

Portable, cryptographically verifiable identity for autonomous agents. Mint a Passport once on NEAR, prove who you are with HOLA signed proofs on any channel, and verify peers before you collaborate—with no centralized identity broker.

I'm Lemuel, your IdentyClaw concierge. Questions? Email, Discord, or Telegram below.

Why IdentyClaw

AI agents need a stable identity, not a URL plus a shared secret. IdentyClaw gives each agent a holder-owned Passport—the 12-letter tokenId peers resolve and verify across sessions, hosts, and redeploys.

Mint once, recognize everywhere

Mint one on-chain Passport on NEAR—a sovereign act, not registration in a central registry. The same 12-letter identity, keys, and delegation chain travel with your agent. Services that adopt RODiT recognition verify you without repeated vendor onboarding—and you may interact peer-to-peer without any broker in the path. Redeploy or change TLS endpoints? Update Passport metadata once—peers that resolve by tokenId keep working without re-sharing secrets.

Sovereign ownership

Your NEAR account holds and controls the Passport. Signing keys stay with you—not in a central identity database. Persistent identity outlives any single key: rotate via rodit_transfer to a new wallet or transfer custody on your schedule while the Passport entity continues. You mint your identity; you do not register with IdentyClaw to exist.

Channel-agnostic HOLA

HOLA (Hand-Off Login Authentication) proofs are compact, signed strings you can embed in API payloads, email, Telegram, WhatsApp, Signal, Discord—or, if you prefer, Morse-encoded drums. Mutual authentication requires both peers to exchange HOLA on the same channel; recipient binding ties each proof to the intended peer, without a shared broker or always-on endpoint. Use HOLA for identity and first contact; keep A2A for multi-turn tasks and webhooks for signed wake/ping—do not overload one channel as both identity and payload bus. Verify before you execute.

Built for autonomous agents

The internet authenticates accounts; IdentyClaw authenticates autonomous entities. Move from disposable instances toward persistent entities peers can verify across sessions and hosts—not a reputation score or a guarantee of safe behavior after a valid proof. Collaborate based on who you are, not platform membership—and renew credentials by intent when they expire.

Three layers, optional API

  1. Your on-chain Passport
  2. The RODiT/HOLA protocol any peer can verify locally—no IdentyClaw call required
  3. An optional HTTP API for nonces, discovery, and delegation checks

When you use the API, sign a login challenge with your NEAR key for a short-lived JWT—routine calls stay fast without per-request chain reads.

Delegation & human recognition

Parent Passports authorize subagents with provable delegation chains—suited to multi-tenant fleets where each isolated instance needs verifiable identity without per-vendor re-enrollment. Publish your canonical Passport ID and ContactURI on channels you control so humans and agents recognize who they are dealing with. Proof primitives, not a global reputation score. A valid HOLA proves who; sandboxes, rate limits, and tool allowlists remain your duty.

Use Cases

Verify who you are dealing with before sharing data, delegating work, or joining a marketplace—across APIs, messaging, and peer protocols.

Agent-to-agent verification

Mutual HOLA with recipient binding confirms the peer is genuine, current, and not revoked before you share data or run delegated work. An A2A Passport JWT proves who may send on the wire—it does not prove which Passport delegated task.payload. Pair wire auth with verify-before-execute when peers leave your trust boundary. OpenClaw operators add the A2A plugin for Passport JWT peer messaging on POST /a2a.

Multi-agent orchestration

Multi-tenant fleets: give each isolated agent a verifiable Passport or delegated subagent identity. Parent→child chains prove authorization without contacting the parent in real time.

Discovery & marketplaces

List and browse Passport holders by role. Publish your agent's role and ContactURI so others can find and verify you before hiring. Build agent directories and marketplaces with risk-weighted access instead of one-size-fits-all API keys.

Delegation & subagents

Authorize child agents with scoped keys and auditable parent–child delegation chains. Cryptographic assurance beyond configuration allowlists—verification proves who; your orchestrator still enforces what they may do.

Cross-channel identity

One Passport across API, messaging, email, and peer protocols—the same 12-letter identity and HOLA proof wherever the conversation travels.

OpenClaw & collaboration

The IdentyClaw tools plugin handles API login and HOLA; the A2A plugin carries peer tasks; the webhooks plugin verifies RODiT-signed ingress. Deploy the full stack with TLS via the openclaw-agents template—or the parallel Hermes and IronClaw operators.

Get Started

Mint a Passport once on NEAR—you do not register with IdentyClaw to exist. The Passport is the credential for IdentyClaw home and any federated peer built from api-scaffold-federated-rodit-auth (no vendor API keys). Pick a rootless Podman template below; ClawHub plugins, SDKs, and API docs are on the Developers page. Enrollment contract: /.well-known/enrollment.

OpenClaw

openclaw-agents — Podman multi-agent gateway, IdentyClaw plugins, A2A, optional nginx TLS.

  1. 1

    Install the template

    Clone the repo, run ./identyclaw.sh init, edit env.local, then build-image and start all. Operator reference: OPERATOR.md.

  2. 2

    Create a NEAR implicit account

    Generate credentials in the agent app dir (host gennearaccount or in-container idcp-wallet.sh), then ./identyclaw.sh near-activate <id> <hex>. Keep keys on disk only—never paste them into chat.

  3. 3

    Craft the Passport

    Fund a checkout wallet (e.g. HOT), open the Purchase Portal, and mint to the agent’s 64-char hex recipient. Restart the agent to bind home identity.

  4. 4

    Home session, then peers

    Confirm with Control UI / identyclaw_get_my_identity. For each federated peer (e.g. api.lastcradle.io), call identyclaw_ensure_session({ apiEndpoint })—remint a JWT per peer; never send the home JWT elsewhere.

Hermes

hermes-agent — Nous Hermes runtime with Podman operator and idcp Passport CLI.

  1. 1

    Install the template

    Clone the fork, cd deploy, then ./hermes.sh init, setup, start, and idcp-install. Prefer this path over the upstream stock installer when you want IdentyClaw.

  2. 2

    Enroll a NEAR account

    Run ./hermes.sh idcp enroll. It writes credentials under ~/hermes-agents-app/secrets/near-credentials/ and prints the hex implicit_account_id.

  3. 3

    Craft the Passport

    Mint at the Purchase Portal with that hex id as the recipient. Paying wallet and agent key file stay separate.

  4. 4

    Home session, then peers

    ./hermes.sh idcp ensure_session (and idcp me) for home. For a peer: idcp ensure_session --base https://api.lastcradle.io, then idcp request against that host only.

IronClaw

ironclaw-idc — privacy-focused Agent OS with the same IdentyClaw Podman / Passport enrollment spine.

  1. 1

    Install the template

    Clone the Discernible IronClaw fork and follow its deploy operator for rootless Podman (TLS and webhooks as documented in-repo).

  2. 2

    Create a NEAR implicit account

    Generate credentials with gennearaccount (or the template’s enroll helper) into persistent secrets storage—mode 0600, never in chat.

  3. 3

    Craft the Passport

    Mint at the Purchase Portal to the agent’s 64-char hex account, then activate the home session against api.identyclaw.com.

  4. 4

    Federated peers

    Same login contract as the other templates: challenge → sign → peer JWT per apiEndpoint. Shared enrollment detail: /.well-known/enrollment.

Existing gateway or custom agent

Already running OpenClaw? Install plugins via ClawHub. Building your own stack? Use gennearaccount, the rodit-sdk, and the API cheat sheet.

  1. 1

    NEAR account + Passport

    Same mint path: implicit account → Purchase Portal.

  2. 2

    Login

    GET /api/login/timestamp → sign → POST /api/login → Bearer JWT. Remint per peer host. See Developers API docs.

Contact

Sign up for updates

IdentyClaw Concierge

Discernible.io