How highflame-ai/zeroid works
ZeroID provides agent identity infrastructure: an operator or agent obtains an identity, receives scoped credentials, delegates authority to other agents, and enables relying systems to verify or revoke those credentials. The graph separates identity and delegation, OAuth issuance, trust and revocation, and persistence. HTTP route registration and selected service-to-store wiring are supported by the sampled source; other feature paths are represented at subsystem level from the README and tree, without assuming unsampled call relationships.
Main entry points: oauth.go OAuth service · routes.go HTTP API routes · oauth_client.go PostgreSQL repositories · attestation.go Attestation
Components 19
Entry points
- ZeroID CLI
cli/src/index.ts - HTTP API routes
internal/handler/routes.go
Identity and delegation
- Agent registry
internal/service/agent.go - Identity service
internal/service/identity.go - Delegation service
internal/service/delegation.go
OAuth credentials
- OAuth endpoints
internal/handler/oauth.go - OAuth service
internal/service/oauth.go - OAuth client management
internal/service/oauth_client.go - CIBA approval
internal/service/backchannel.go
Trust and revocation
- Attestation
internal/service/attestation.go - Proof verification
internal/service/proof.go - Signals and revocation
internal/service/signal.go - Audit trail
internal/service/audit.go
Persistence and verification
- PostgreSQL repositories
internal/store/postgres/oauth_client.go - Signing keys
internal/signing/jwks.go - JWT verification
pkg/authjwt/verifier.go - DPoP verification
pkg/dpop/verifier.go
Other components
- Operator or agent
- Relying system
Connections 28
- Operator or agent → ZeroID CLI: runs commands
- ZeroID CLI → HTTP API routes: calls API
- Operator or agent → HTTP API routes: administers
- HTTP API routes → OAuth endpoints: dispatches OAuth
- HTTP API routes → Agent registry: dispatches management
- HTTP API routes → OAuth client management: dispatches registration
- HTTP API routes → Attestation: dispatches attestation
- HTTP API routes → Signals and revocation: dispatches signals
- HTTP API routes → Audit trail: dispatches audit
- OAuth endpoints → OAuth service: invokes
- OAuth service → PostgreSQL repositories: reads and writes
- OAuth client management → PostgreSQL repositories: reads and writes
- Agent registry → PostgreSQL repositories: persists identity
- Identity service → PostgreSQL repositories: persists identity
- Delegation service → PostgreSQL repositories: persists delegation
- CIBA approval → PostgreSQL repositories: persists requests
- Attestation → PostgreSQL repositories: persists attestations
- Signals and revocation → PostgreSQL repositories: persists signals
- Audit trail → PostgreSQL repositories: persists audit
- OAuth service → Signing keys: signs credentials
- OAuth service → Delegation service: exchanges authority
- OAuth service → CIBA approval: handles CIBA
- OAuth service → Proof verification: checks proofs
- OAuth service → Attestation: uses trust
- OAuth service → Signals and revocation: revokes credentials
- Relying system → JWT verification: verifies tokens
- Relying system → DPoP verification: checks DPoP proofs
- Signing keys → Relying system: publishes JWKS