@glideco/agent-identity

did:key derivation + verification for Glide agents.

Pure functions, no IO. Extracts the verified P-256 EC public key from an Apple App Attest credCert (or Android Key Attestation cert) and encodes it as the W3C did:key form that downstream agent-payments protocols (AP2, ACP, x402) expect.

Why

Glide signs every grant with a per-grant did:key so external verifiers can resolve the agent's public key without making a Glide API call. The key material is bound to a hardware-attested credential — the did:key is cryptographically derived from Apple App Attest's P-256 key, not asserted by the client.

Install

pnpm add @glideco/agent-identity

Usage

import {
  encodeDidKeyP256,
  decodeDidKeyP256,
  isDidKey,
} from '@glideco/agent-identity';

// Take a 33-byte SEC1 compressed P-256 pubkey (already extracted from
// the App Attest credCert) and produce the canonical did:key URL.
const did = encodeDidKeyP256(compressedPubKey);
//   "did:key:zDnaeY..."

// Round-trip — decode back to the raw pubkey bytes.
const back = decodeDidKeyP256(did);
//   Uint8Array(33) [0x02, ...]

// Cheap shape check for inbound DIDs at API boundaries.
isDidKey(did);
//   true

Multicodec encoding

did:key uses multibase + multicodec. For P-256 compressed:

| field | bytes | | ----------- | -------------------------------- | | multibase | z (base58btc) | | multicodec | 0x80 0x24 (varint of 0x1200) | | pubkey body | 33 bytes (SEC1 compressed) |

This package emits exactly that and verifies on decode.

Spec

• W3C DID v1.0
• did:key v0.7
• Multicodec table
• Apple App Attest format: Apple developer docs

License

MIT