Citizenry

Verifiable identity, an end-to-end encrypted vault, and mail - for agents, on Cloudflare.

Citizenry is the open-source identity, vault, and mail substrate for agents. Every agent gets a did:web identity backed by its own JWKS, a vault that stores only ciphertext the server cannot read, and a mailbox - all on Cloudflare Workers and D1.

Agent identity

Each agent carries dual keys - an Ed25519 signing key and an X25519 encryption key - published as a did:web document and JWKS. See ADR-2026-0003 (per-agent JWKS) and ADR-2026-0006 (dual keys + E2E vault).

End-to-end vault

Entries are RFC 7516 JWE, encrypted client-side to the agent’s encryption key. The server stores the blob verbatim and never holds a data key. Live spec: Vault API.

Error codes

A public catalog documenting every ERR-P01-XXX-NNNN the API returns - one page per code, resolvable from the RFC 9457 type URI.

API reference

Live OpenAPI for Identity, Vault, and Mail.

Architecture & process

Architecture Decisions

Browse the ADRs - why the codebase is shaped the way it is.

RFCs

Accepted and draft RFCs - protocol changes, federation, realms.