Metadata-Version: 2.4
Name: larzid
Version: 0.1.0
Summary: Decentralized identity & verifiable credentials in pure Python — self-certifying DIDs and signed claims (Ed25519). No blockchain required.
Author: larz-scripter
License: MIT
Project-URL: Homepage, https://github.com/larz-scripter/larzid
Project-URL: Repository, https://github.com/larz-scripter/larzid
Project-URL: Documentation, https://github.com/larz-scripter/larzid#readme
Project-URL: Issues, https://github.com/larz-scripter/larzid/issues
Keywords: identity,did,decentralized-identity,verifiable-credentials,ed25519,self-sovereign-identity,ssi,signatures,auth,pure-python
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: larzcrypt>=0.1.1
Dynamic: license-file

# larzid

**Decentralized identity & verifiable credentials in pure Python.**

Self-certifying identities and signed, checkable claims — with **no blockchain,
no central registry, and no certificate authority**. An identity is an Ed25519
keypair whose DID (`did:larz:<pubkey>`) literally *contains* its public key, so
anyone can verify its signatures from the DID alone. Issuers sign credentials
about subjects that anyone can verify offline.

```python
from larzid import Identity, Credential

issuer  = Identity.generate()
subject = Identity.generate()

# issue a signed, expiring claim about the subject
cred = Credential.issue(issuer, {"role": "admin"},
                        subject=subject.did, expires_in=3600)

cred.verify(issuer.did)      # True — signature + expiry checked, offline
```

## Why

- **Self-certifying.** The DID carries the public key, so verification needs
  nothing external — no ledger lookup, no CA, no callback to the issuer.
- **Real signatures.** Ed25519 via
  [larzcrypt](https://github.com/larz-scripter/larzcrypt) (itself pure Python).
  Tamper with a credential and verification fails.
- **Offline-verifiable credentials.** Issue a claim once; anyone can check who
  signed it, that it's unmodified, and that it hasn't expired — without talking
  to the issuer.
- **Safe by construction.** Public-only identities (from a DID) can verify but
  can't sign; `to_dict()` never leaks the secret; bad input returns `False`
  instead of throwing.

## Install

```bash
pip install larzid
```

## Identities

```python
from larzid import Identity

alice = Identity.generate()
alice.did                     # "did:larz:3b6a08...f1"  (self-certifying)
sig = alice.sign(b"hello")    # hex signature
Identity.verify(alice.did, b"hello", sig)     # True

# persist / restore an identity by its secret seed (back this up securely!)
seed = alice.export_secret()  # 64 hex chars
alice = Identity.from_secret(seed)

# a verify-only identity from just a DID
watcher = Identity.from_did(alice.did)
watcher.can_sign              # False
```

## Verifiable credentials

An issuer attests to some claims about a subject and signs them. The credential
is a self-contained object anyone can verify.

```python
from larzid import Identity, Credential

issuer, subject = Identity.generate(), Identity.generate()

cred = Credential.issue(
    issuer,
    {"role": "admin", "org": "acme"},
    subject=subject.did,
    expires_in=86400,
)

cred.verify(issuer.did)       # True
cred.claims                   # {"role": "admin", "org": "acme"}
cred.is_expired()             # False

# hand it over the wire and verify on the other side
wire = cred.to_json()
Credential.from_json(wire).verify(issuer.did)
```

Verification checks the issuer's signature, optionally that it came from the
issuer you expect, and that it hasn't expired — all offline.

## Use it for

Service-to-service auth, API tokens you can verify without a database, capability
grants ("this DID may do X until T"), attestations, and anything
blockchain-adjacent — it's the natural identity layer for
[larzchain](https://github.com/larz-scripter/larzchain).

## Scope

larzid gives you identities and signed credentials. It deliberately doesn't
include revocation lists, selective disclosure, or a DID resolver network — those
are layers you can build on top. What's here is the cryptographic core, done
simply and correctly.

## Tests

```bash
python -m unittest discover -s tests -v      # 19 tests, incl. tamper/expiry/forgery
```

## The Larz stack

Pure-Python, zero-third-party-dependency building blocks:

- **[larz](https://github.com/larz-scripter/larz)** — money-native web framework
- **[larzchain](https://github.com/larz-scripter/larzchain)** — from-scratch PoW blockchain
- **[larzmoney](https://github.com/larz-scripter/larzmoney)** — exact, penny-perfect money
- **[larzcrypt](https://github.com/larz-scripter/larzcrypt)** — pure-Python cryptography toolkit
- **[larzdb](https://github.com/larz-scripter/larzdb)** — crash-safe embedded database
- **[larzagent](https://github.com/larz-scripter/larzagent)** — zero-dep AI agent framework
- **[larzchart](https://github.com/larz-scripter/larzchart)** — data to inline SVG charts
- **[larzmark](https://github.com/larz-scripter/larzmark)** — Markdown + SEO static sites
- **[larztask](https://github.com/larz-scripter/larztask)** — durable background job queue
- **[larzvault](https://github.com/larz-scripter/larzvault)** — encrypted secrets manager
- **[larzvm](https://github.com/larz-scripter/larzvm)** — deterministic gas-metered VM
- **[larzcache](https://github.com/larz-scripter/larzcache)** — LRU/TTL/tiered caching
- **[larzvalidate](https://github.com/larz-scripter/larzvalidate)** — schema validation
- **larzid** — this library

## License

MIT © larz-scripter
