Demo service on firstperson.dev · open source

A home for your Trust Agent.

VTA Farm hosts Verifiable Trust Agents: the always-on service that holds your identity keys, publishes your DID and talks to other agents for you. Sign in with a passkey, choose a name, scan a QR code with Keyring. That's it.

Create your agent → Run your own farm

Apache 2.0 · Passkey sign-in, no passwords · Email optional, nothing else asked

Trustie, the VTA Farm agent, powering up and floating above the provisioning platform Trustie, the VTA Farm agent, powering up and floating above the provisioning platform
Meet Trustie. Every agent starts out like this.

What a Trust Agent does

Your agent, working while you're offline.

01

Holds your keys

It keeps the keys behind your identity, so others can verify you even when your phone is off.

02

Has a public address

It publishes a did:webvh identifier at its own web address, so anyone can look you up and check what you sign.

03

Speaks for you

It exchanges private DIDComm messages and credentials with other agents through a mediator.

04

Answers to you

Your device is its admin. Manage it from the Keyring app on your phone, or with pnm on your laptop.

How it works

From sign-in to live agent.

  1. Sign in with a passkey

    No password to create, forget or leak. Your device is your login.

  2. Choose what to build

    A Personal Trust Agent for yourself, or a Verifiable Trust Community to run a group.

  3. Watch the Farm build it

    Each phase shows up in the portal as it runs:

    DNS & environment Agent setup Publish DID Admin DID Deploy agent

  4. Connect your device

    Scan the QR code with Keyring and check that the six-character code matches on both screens. Prefer the terminal? Run pnm setup and paste your did:key.

Trustie half-built on the provisioning platform while a welding arm and scan line work on it Trustie half-built on the provisioning platform while a welding arm and scan line work on it
Step 3, in progress.

Agent or full stack

Just an agent, or the whole stack.

Open to everyone

Trust Agent

Your own agent, plugged into the Farm's shared mediator and DID host. The fastest way to an identity of your own.

  • Your own did:webvh identity
  • Shared mediator and DID hosting, nothing to run
  • Self-service upgrades with automatic rollback
  • Up to two agents per account

Fullstack Access, granted by an admin

Full stack

Four services of your own, each at its own address. Built for communities that want their own trust infrastructure.

  • Your Trust Agent
  • A DIDComm mediator
  • did:webvh DID hosting
  • A Verifiable Trust Community: join requests, credential issuance, an admin site and a public website
  • Custom domains with automatic certificates (rolling out)

Hosting an event?

Pre-build a batch of agents ahead of time. Attendees scan a QR code at a claim station, confirm the code, and leave with a live agent on their phone.

Trustie fully built, floating with a checkmark badge Trustie fully built, floating with a checkmark badge

Security

Built to be checked, not taken on faith.

Every part of the Farm is open source, and so are its limits. Here is exactly where your keys live and who can see what.

A space of your own

Each account runs in its own isolated Kubernetes namespace.

Keys kept in Vault

Your agent's master seed lives in HashiCorp Vault, behind a policy only your agent can use. Never in plain text.

The Farm can't read your seed

The Farm's own API has no read access to any agent's seed. It can grant and remove access, nothing more.

Next to no personal data

Email is optional and never verified. Passkeys mean there is no password to store.

Backed up, and tested

Cluster snapshots every six hours, volume and Vault backups, and documented restore drills.

Upgrades that undo themselves

Move your agent to a new version yourself. If it isn't healthy within five minutes, it rolls back.

What Farm operators can see

Admins can list setup sessions, follow setup logs and download a session's configuration export, which includes the credentials generated during setup. We would rather you hear it from us.

No blockchain. No tokens.

Just open standards: DIDs, DIDComm and Verifiable Credentials.

Run your own

Rather not trust us? Run your own farm.

We want many farms, not one. Everything that runs this one is published under Apache 2.0, right down to the infrastructure code.

ic3software/vtafarmThe portalThe web app you sign in to, built with React. ic3software/vtafarm-apiThe provisioning APIBuilds, upgrades and connects agents. Go and PostgreSQL. ic3software/vtafarm-k8sThe infrastructureThe whole cluster as code, with OpenTofu on Kubernetes.
Hetzner Cloud OpenTofu k3s + Rancher RKE2 HashiCorp Vault Longhorn cert-manager Traefik Let's Encrypt

Your agent is one scan away.

This is a demo service. It may be reset, and it may stop accepting new agents when it runs out of space.

Create your agent → Read the setup guide