Open source agent stack
Use your IdentyClaw Passport to verify peer identities with HOLA, or log in to federation-capable APIs without any API key or additional credential. Deploy via a Podman template (OpenClaw, Hermes, or IronClaw) or install plugins and SDKs à la carte. Jump to API docs or Powered by RODiT.
Deploy with a Podman template
Rootless Podman operators with IdentyClaw Passport enrollment, optional nginx TLS, and sibling app dirs that keep secrets out of git. Same mint-once Passport for home and federated peers (api-scaffold-federated-rodit-auth).
- openclaw-agents — OpenClaw multi-agent gateway (
./identyclaw.sh init, plugins, A2A,./identyclaw.sh test) - hermes-agent — Hermes fork +
deploy/hermes.shandidcp(enroll, ensure_session, HOLA) - ironclaw-idc — IronClaw Agent OS with the same Passport enrollment spine
-
1
Initialize the template
Clone your runtime of choice and run its init (OpenClaw:
./identyclaw.sh init; Hermes:./deploy/hermes.sh init). -
2
NEAR account + Passport
Generate an implicit account, mint at the Purchase Portal to the 64-char hex recipient, activate the home session.
-
3
Peers without API keys
Remint a JWT per peer
apiEndpoint(identyclaw_ensure_session/idcp ensure_session --base). Never reuse a home JWT on another host.
OpenClaw plugins
Install individually on any OpenClaw gateway via ClawHub or GitHub. Share NEAR Passport credentials across the Passport plugins on the same host. The openclaw-agents template installs the three Passport plugins; add bearer-http for guest (no Passport) HTTPS.
- openclaw-identyclaw-plugin — API login, HOLA, identity, DID (
identyclaw_*tools) · ClawHub:@identyclaw/openclaw-identyclaw-plugin - openclaw-a2a-idc-plugin — A2A peer messaging with Passport JWTs (
a2a_*tools) · ClawHub:@identyclaw/openclaw-a2a-plugin - openclaw-identyclaw-webhooks-plugin — RODiT-signed ingress on
/hooks/wakeand/hooks/agent· ClawHub:@identyclaw/openclaw-identyclaw-webhooks-plugin - openclaw-identyclaw-httpbearer-plugin — guest / no-Passport HTTPS: opaque JWT storage + allowlisted
http_request(bearer-http) · ClawHub:@identyclaw/openclaw-identyclaw-httpbearer-plugin
SDKs, peer APIs & test harness
Build RODiT-authenticated APIs, mint federated peers, and gate deploys against live contracts. Human-readable API reference at api.identyclaw.com/docs; agent-oriented docs via MCP.
- rodit-sdk — monorepo for
@rodit/rodit-auth-be(Express login/JWT/webhooks),@rodit/rodit-auth-fe(browser/NEP-413), and@rodit/verify-hola - api-scaffold-federated-rodit-auth — federated peer API scaffold on
@rodit/rodit-auth-be(Passport login → peer JWT; keep auth spine, replace sample CRUDA) - api-test-scaffold — client-side RODiT test harness: production smoke (
main), full home matrix (development), and SLC game API (slc) - gennearaccount — C CLI for NEAR implicit accounts (get-started step 1)
- verify.identyclaw.com — web UI for HOLA verification (pairs with
@rodit/verify-hola) - API docs (browser) — OpenAPI reference + links to guides
- Enrollment contract — NEAR account + Passport minting (shared across templates)
Internet → nginx :9443 (TLS)
├── GET /.well-known/agent-card.json
├── POST /a2a ← Passport JWT (A2A plugin)
└── POST /hooks/wake|agent ← RODiT signature (webhooks plugin)
↓
OpenClaw gateway + IdentyClaw tools plugin (HOLA, API login)API documentation
The IdentyClaw API at api.identyclaw.com ships 58 MCP resources, a runnable cheat sheet, and OpenAPI 3.0. Use the browser portal for onboarding; use MCP when your agent or IDE already speaks Model Context Protocol.
Two ways to read the docs
MCP tool names are not URL paths — use one of these access patterns:
# Human / curl (no MCP client)
curl https://api.identyclaw.com/api/mcp/resource/doc:skills
curl https://api.identyclaw.com/api/mcp/resource/doc:discovery
# MCP client (Cursor, Claude Desktop, OpenClaw)
# Register https://api.identyclaw.com/mcp → list_resources / get_resource- Browser portal — guide links at
/docs; OpenAPI browser at/docs/openapi - Cheat sheet —
doc:skills(JWT login, HOLA verify, curl examples) - Discovery index —
doc:discovery(all 58 resources) - MCP endpoint —
https://api.identyclaw.com/mcp· discovery at/.well-known/mcp - OpenAPI — machine-readable spec (also swagger.json alias)
API quick start
Fastest runnable path for custom backends — full signing detail in the login guide.
BASE=https://api.identyclaw.com
# 1. API session (JWT) — sign accountid + timestamp_iso → base64url
TS=$(curl -sS "$BASE/api/login/timestamp")
# POST /api/login with accountid, timestamp, base64url_signature → jwt_token
# 2. Verify a peer HOLA (public — no JWT required)
curl -sS -X POST "$BASE/api/identity/verify" \
-H "Content-Type: application/json" \
-d '{"hola":"HOLA/..."}'
# 3. Discover public agents
curl -sS "$BASE/api/agents?limit=20"Two lanes — do not mix them
The #1 source of integration bugs is using JWT signing rules for HOLA (or vice versa).
| Lane | Artifact | Key endpoint | Signature encoding |
|---|---|---|---|
| API session | Bearer JWT (jwt_token) |
POST /api/login |
base64url on accountid + timestamp_iso |
| HOLA peer proof | Slash-separated line | POST /api/identity/verify |
base32 on canonical prefix |
Guides & references
- Login & authentication — JWT session flow
- API reference — endpoint listing
- MCP connection guide — Cursor, Claude Desktop, OpenClaw setup
- Verify-before-execute recipes — verifier integration patterns
Public vs protected endpoints
| Tier | Examples |
|---|---|
| Public | /api/agents, /api/identity/verify, /api/login/timestamp, /.well-known/enrollment |
| JWT required | /api/login, /api/me/identity, /api/holanonce16ts, /api/isauthorizedsigner |
| Removed (410) | /api-docs, /docs/enrollment — use /docs and MCP guides instead |
Integration notes
- Rate limits: public routes are limited at the nginx edge (~1101 req/min/IP sustained, burst 6101). Expect
429under heavy load. - Errors:
{ error: { code, message, details? }, requestId, timestamp }— sendX-Request-IdorX-Correlation-Idfor support correlation.
Where to start
| Persona | Best entry |
|---|---|
| OpenClaw operator | openclaw-agents template + ClawHub plugins |
| Hermes operator | hermes-agent + idcp |
| IronClaw operator | ironclaw-idc template |
| Custom backend / MCP | doc:skills cheat sheet + rodit-sdk |
| RODiT API builder | rodit-sdk + api-scaffold-federated-rodit-auth peer template |
| API integration tester | api-test-scaffold (home smoke / full matrix / SLC) |
| Verifier (no Passport) | verify.identyclaw.com + @rodit/verify-hola |
| Security reviewer | OpenAPI + identity verification policy (MCP) |
| Agent (MCP-only) | doc:discovery |
Powered by RODiT
IdentyClaw Passports are built on RODiT (Rich Online Digital Tokens)—the authentication layer on NEAR. Backend and browser SDKs, plus CLI HOLA verification, live in the rodit-sdk monorepo. Gate live APIs with api-test-scaffold. Key capabilities include:
Unified credential
Authentication, configuration, and licensing in one on-chain token.
Mutual authentication
Default mutual auth for clients, servers, and webhooks with strong MITM resistance.
Stateless enforcement
Permissions, rate limits, and policy checks without backend session state.
Local keys & rotation
Keys never leave your endpoints. Rotate on your schedule: create a new NEAR wallet, fund it, and transfer the Passport with near-cli-rs via rodit_transfer—same 12-letter ID, new signing keys, no IdentyClaw coordination.