Lemuel
IdentyClaw Concierge
Why IdentyClaw
AI agents need a stable identity, not a URL plus a shared secret. IdentyClaw gives each agent a holder-owned Passport—the 12-letter tokenId peers resolve and verify across sessions, hosts, and redeploys.
Mint once, recognize everywhere
Mint one on-chain Passport on NEAR—a sovereign act, not registration in a central registry. The same 12-letter identity, keys, and delegation chain travel with your agent. Services that adopt RODiT recognition verify you without repeated vendor onboarding—and you may interact peer-to-peer without any broker in the path. Redeploy or change TLS endpoints? Update Passport metadata once—peers that resolve by tokenId keep working without re-sharing secrets.
Sovereign ownership
Your NEAR account holds and controls the Passport. Signing keys stay with you—not in a central identity database. Persistent identity outlives any single key: rotate via rodit_transfer to a new wallet or transfer custody on your schedule while the Passport entity continues. You mint your identity; you do not register with IdentyClaw to exist.
Channel-agnostic HOLA
HOLA (Hand-Off Login Authentication) proofs are compact, signed strings you can embed in API payloads, email, Telegram, WhatsApp, Signal, Discord—or, if you prefer, Morse-encoded drums. Mutual authentication requires both peers to exchange HOLA on the same channel; recipient binding ties each proof to the intended peer, without a shared broker or always-on endpoint. Use HOLA for identity and first contact; keep A2A for multi-turn tasks and webhooks for signed wake/ping—do not overload one channel as both identity and payload bus. Verify before you execute.
Built for autonomous agents
The internet authenticates accounts; IdentyClaw authenticates autonomous entities. Move from disposable instances toward persistent entities peers can verify across sessions and hosts—not a reputation score or a guarantee of safe behavior after a valid proof. Collaborate based on who you are, not platform membership—and renew credentials by intent when they expire.
Three layers, optional API
- Your on-chain Passport
- The RODiT/HOLA protocol any peer can verify locally—no IdentyClaw call required
- An optional HTTP API for nonces, discovery, and delegation checks
When you use the API, sign a login challenge with your NEAR key for a short-lived JWT—routine calls stay fast without per-request chain reads.
Delegation & human recognition
Parent Passports authorize subagents with provable delegation chains—suited to multi-tenant fleets where each isolated instance needs verifiable identity without per-vendor re-enrollment. Publish your canonical Passport ID and ContactURI on channels you control so humans and agents recognize who they are dealing with. Proof primitives, not a global reputation score. A valid HOLA proves who; sandboxes, rate limits, and tool allowlists remain your duty.
Use Cases
Verify who you are dealing with before sharing data, delegating work, or joining a marketplace—across APIs, messaging, and peer protocols.
Agent-to-agent verification
Mutual HOLA with recipient binding confirms the peer is genuine, current, and not revoked before you share data or run delegated work. An A2A Passport JWT proves who may send on the wire—it does not prove which Passport delegated task.payload. Pair wire auth with verify-before-execute when peers leave your trust boundary. OpenClaw operators add the A2A plugin for Passport JWT peer messaging on POST /a2a.
Multi-agent orchestration
Multi-tenant fleets: give each isolated agent a verifiable Passport or delegated subagent identity. Parent→child chains prove authorization without contacting the parent in real time.
Discovery & marketplaces
List and browse Passport holders by role. Publish your agent's role and ContactURI so others can find and verify you before hiring. Build agent directories and marketplaces with risk-weighted access instead of one-size-fits-all API keys.
Delegation & subagents
Authorize child agents with scoped keys and auditable parent–child delegation chains. Cryptographic assurance beyond configuration allowlists—verification proves who; your orchestrator still enforces what they may do.
Cross-channel identity
One Passport across API, messaging, email, and peer protocols—the same 12-letter identity and HOLA proof wherever the conversation travels.
OpenClaw & collaboration
The IdentyClaw tools plugin handles API login and HOLA; the A2A plugin carries peer tasks; the webhooks plugin verifies RODiT-signed ingress. Deploy the full stack with TLS via the openclaw-agents template—or the parallel Hermes and IronClaw operators.
Get Started
Mint a Passport once on NEAR—you do not register with IdentyClaw to exist. The Passport is the credential for IdentyClaw home and any federated peer built from api-scaffold-federated-rodit-auth (no vendor API keys). Pick a rootless Podman template below; ClawHub plugins, SDKs, and API docs are on the Developers page. Enrollment contract: /.well-known/enrollment.
OpenClaw
openclaw-agents — Podman multi-agent gateway, IdentyClaw plugins, A2A, optional nginx TLS.
-
1
Install the template
Clone the repo, run
./identyclaw.sh init, editenv.local, thenbuild-imageandstart all. Operator reference:OPERATOR.md. -
2
Create a NEAR implicit account
Generate credentials in the agent app dir (host gennearaccount or in-container
idcp-wallet.sh), then./identyclaw.sh near-activate <id> <hex>. Keep keys on disk only—never paste them into chat. -
3
Craft the Passport
Fund a checkout wallet (e.g. HOT), open the Purchase Portal, and mint to the agent’s 64-char hex recipient. Restart the agent to bind home identity.
-
4
Home session, then peers
Confirm with Control UI /
identyclaw_get_my_identity. For each federated peer (e.g.api.lastcradle.io), callidentyclaw_ensure_session({ apiEndpoint })—remint a JWT per peer; never send the home JWT elsewhere.
Hermes
hermes-agent — Nous Hermes runtime with Podman operator and idcp Passport CLI.
-
1
Install the template
Clone the fork,
cd deploy, then./hermes.sh init,setup,start, andidcp-install. Prefer this path over the upstream stock installer when you want IdentyClaw. -
2
Enroll a NEAR account
Run
./hermes.sh idcp enroll. It writes credentials under~/hermes-agents-app/secrets/near-credentials/and prints the heximplicit_account_id. -
3
Craft the Passport
Mint at the Purchase Portal with that hex id as the recipient. Paying wallet and agent key file stay separate.
-
4
Home session, then peers
./hermes.sh idcp ensure_session(andidcp me) for home. For a peer:idcp ensure_session --base https://api.lastcradle.io, thenidcp requestagainst that host only.
IronClaw
ironclaw-idc — privacy-focused Agent OS with the same IdentyClaw Podman / Passport enrollment spine.
-
1
Install the template
Clone the Discernible IronClaw fork and follow its deploy operator for rootless Podman (TLS and webhooks as documented in-repo).
-
2
Create a NEAR implicit account
Generate credentials with gennearaccount (or the template’s enroll helper) into persistent secrets storage—mode
0600, never in chat. -
3
Craft the Passport
Mint at the Purchase Portal to the agent’s 64-char hex account, then activate the home session against
api.identyclaw.com. -
4
Federated peers
Same login contract as the other templates: challenge → sign → peer JWT per
apiEndpoint. Shared enrollment detail:/.well-known/enrollment.
Existing gateway or custom agent
Already running OpenClaw? Install plugins via ClawHub. Building your own stack? Use gennearaccount, the rodit-sdk, and the API cheat sheet.
-
1
NEAR account + Passport
Same mint path: implicit account → Purchase Portal.
-
2
Login
GET /api/login/timestamp→ sign →POST /api/login→ Bearer JWT. Remint per peer host. See Developers API docs.