Identus.Companion

Self-sovereign identity toolkit

Learn and operate Hyperledger Identus without the setup tax.

Run a real Cloud Agent — simulated, on Docker, or deployed to Fly.io in a few clicks. Prove claims from issued credentials with zero-knowledge proofs in the browser. Let AI agents transact under a delegation credential they have to earn.

Start with the simulated agent Read the primer New to SSI? Start here

3: agent modes
4: agentic protocols
0: claims disclosed

JWT verifiable credential

Student ID

Holder: did:prism:9f3c…a41d
Issuer: did:prism:1e77…b0c2
Claim: dob 2003-05-12
Status: Signed & stored

ZK proof

over18 = true

dob disclosed = false

Delegation

Agent may spend up to 5 USDC at one merchant.

mandate verified

In the console

Beyond the basics

The console goes past DIDs and credentials — these three panels are where the newer work lives.

Noir circuit

Zero-knowledge proofs

Pick a credential you actually hold and prove “over 18” with a Noir circuit running in your browser — the date of birth never leaves the page, only the proof does.

Open the ZK panel

A2A · AP2 · UCP · x402

Agentic commerce

Settlement on Base Sepolia only happens when the agent's delegation credential and its principal's identity both pass the Identus gate.

Run the demos

Scratch box

SDK sandbox

Runnable Identus TypeScript snippets, a Docker Compose lab and a quickstart for delegation credentials — no agent stack required.

Open the sandbox

Choose your backend

Three agent modes

Switch mode at any time — the console keeps the same workflows, only the backing agent changes.

Zero setup

Simulated

A deterministic in-app agent that mirrors the Cloud Agent REST semantics. Issue, hold and verify credentials instantly.

Your machine

Docker local

Point the app at a Cloud Agent running from the Identus Docker Compose stack on localhost and drive it over REST.

Real deployment

Fly.io

Provision Postgres, a PRISM node and the Cloud Agent as Fly machines with your organisation token, straight from the wizard.

Capabilities

What you can do in the console

DID registrar

Create and publish did:prism identifiers with issuer, holder or verifier roles.

DIDComm connections

Generate out-of-band invitations and walk the connection state machine.

Credential issuance

Offer, accept and store W3C JWT verifiable credentials against a schema.

Presentation & proof

Request a presentation and inspect each verification check individually.

Schema registry

Define credential schemas with versioned attribute sets.

Activity trail

Every protocol step is logged so you can trace exactly what the agent did.

Delegation credentials

Issue a mandate that lets an AI agent act for a human, with scope and spend limits baked in.

ZK-bound presentations

Commit to a real issued credential and prove a predicate about it without disclosing the claim.

Snippet library

Runnable Identus TypeScript snippets and a Compose lab in your own sandbox, versioned as the SDK moves.

Context

Learn the concepts

Self-sovereign identity, explained

No jargon: what changes for web2 and web3, how the trust triangle works, and interactive walkthroughs of credential issuance, AI-agent delegation and zero-knowledge proofs.

Read the guide

NHS single patient record

A worked example of what NHS England's single patient record could look like when the patient holds verifiable credentials instead of every service holding a copy.

See the scenario