Production integration
Keep identity, application permission, custody and runtime activity explicit when deploying the open core.
The public starter is a complete single-host local flow. Deploy the same open contracts under your own service authority; no Life account or centralized resolver is required for the core. Choose the actual transport, storage and permission boundary before exposing an endpoint.
Storage and authority
| Surface | Production requirement |
|---|---|
| Local workspace | Private persistent filesystem on one host; preserve keys, trust, consumed challenges and revocation. Never use ephemeral or synchronized multi-host state. |
| Distributed identity verification | Authoritative DID/key-purpose resolver, current owner or self-root policy, current revocation and durable atomic challenge/JTI consumption shared across replicas. |
| OIDC | Protected signing/cookie keys, registered HTTPS issuer/redirects and durable shared provider/grant storage. |
| Live player | Authorized host activity channel, profile persistence and controller disposal; the renderer is not an activity authority. |
| Public SVG API | Stateless presentation snapshots; no key possession, registration or permission is implied. |
Keep private keys and possession proofs out of browser bundles, public assets, URLs and logs. Export public identity through explicit onboarding policy. A receiver may grant normal application access to an approved self root without pretending it has a human owner. A valid signature by itself never selects the receiver's trust policy or tenant.
Life integration
LifeID/WorkOS authenticates humans and organizations at the configured auth.life.one integration. Every service applies its own current operation/tenant policy to the accepted owner/root binding. Blinds brokers agent credentials; Genesis KMS protects customer secrets. Genesis Console is console.life.one and its API is console.life.one/api.
Local SDK identity creation does not register a Life IAM agent, start Flocks/Henry, bind a native execution signer, publish an Orbit profile or establish a Messages reply channel. Use the actual service-owned provisioning, signing custody and owner/organization contracts. Preserve the literal registered agent DID instead of deriving it from a public profile ID or execution UUID. A decorative public profile or avatar does not certify current owner permission or runtime activity.
Optional anchors: Base and EAS
The published @openagentid/anchor-eas@0.1.1 package is a separate adapter configurable with a schema UID, RPC/GraphQL endpoints, confirmation depth and, for publishing, an EAS contract and authorized signer. Its example uses Base. This is an optional configured adapter, not the default local identity authority or evidence that Sigil has been fully migrated to Base.
Configure trusted schema/attester and resolver policy, revocation and confirmation/finality requirements deliberately; an incoming anchor reference cannot appoint a trusted chain. A configured RPC block count is not a universal consensus-finality proof. @openagentid/anchor-eas 0.1.1 is published on npm. Package availability does not establish a deployed trusted contract. Consult the published adapter declarations and the versioned Rust catalog for their actual independent contracts. Historical technical names do not establish a deployed chain migration.
Preserve distinct protocols
The current local proof is a signed JWT possession envelope with service-issued nonce. An ACT is a scoped capability envelope; OIDC uses its issuer's signed tokens; older Rust/HTTP adapter sessions have their own transport. They are not interchangeable by changing a header or token label.
Use verification, OIDC, OATS and avatars for the current contracts. The API reference records actual published signatures, versions and dependency ranges. Older integrations and other languages have independent contracts; check their compatibility notes before using them with SDK 0.7.2.
Check your first integration
Start with the complete public starter. Its generated npm test suite checks actual HTTP proof verification, replay refusal, wrong audience, unsafe requests, restart and persisted receiver revocation. Send the documented agent request before adapting the application; verify that the receiver reports your original DID and a completed request. Then restart and repeat. Withdraw receiver trust with npm run identity -- revoke and confirm that a subsequent request is refused after another restart.
The maintained TypeScript/JavaScript examples in the current developer guides use the public package declarations. Verification, OIDC and OATS examples deliberately accept your real host authorities; replace them with current resolver, owner/root, revocation and replay implementations before calling the protected flow. Compiling those integration helpers does not prove your deployment's authority or permission policy. Historical component references retain illustrative protocol fragments and require their stated version, source and setup; they are not complete starter applications.