Skip to main content

The protocol

Underneath the DFOS product is an open protocol — a cryptographic identity and authorship layer that makes who-you-are and what-you-made independently verifiable, without trusting our servers to say so.

It runs on ordinary web infrastructure. There's no blockchain, no token, no wallet to manage — just signed records and content-addressed data that anyone can check.

Four things to know:

  • Every identity on DFOS is a protocol identity. Accounts, spaces, and groups each get a permanent cryptographic identifier (a did:dfos DID) backed by a chain of signed operations, created automatically — nothing to set up.
  • Keys come in three kinds. DFOS holds a platform key and signs on your behalf, which is what lets you sign in with a code sent to your email. You can add signing keys you hold yourself, on your own machine, which DFOS never sees the private half of. And you can add an exit key in the controller role, so the identity can continue beyond DFOS. See Sessions & keys.
  • Posts are on the protocol too. A publicly readable post gets its own signed content chain on the public relay — verifiable authorship for the work, not just the identity behind it. A members-only post can anchor an existence proof instead — proof that the space published something at that moment, with no way to read it and no author disclosed. That one is off by default: a space opts in to publishing existence proofs about its private posts.
  • It's open. The protocol specification is published, the libraries and relay software are open source at github.com/metalabel/dfos, and the public relay is live for anyone to read — see Relays & verification. To check something without installing anything, explore.dfos.com resolves any identity or content chain and recomputes every check in your own browser.

This section covers: