> ## Documentation Index > Fetch the complete documentation index at: https://docs.nuwa.dev/llms.txt > Use this file to discover all available pages before exploring further. # Identity Kit > About Nuwa Identity Kit ## Overview `@nuwa-ai/identity-kit` provides DID creation, resolution, key management, and DIDAuth v1 signing/verification. It supports multiple DID methods (e.g., `did:rooch`, `did:key`) and follows NIP-1 (single DID, multi-key) and NIP-2 (DIDAuth v1). ## Install ```bash theme={null} pnpm add @nuwa-ai/identity-kit @roochnetwork/rooch-sdk ``` ## CLI for agent environments If you need a zero-code DIDAuth flow for agent environments, use the `nuwa-id` CLI: ```bash theme={null} npm i -g @nuwa-ai/identity-kit nuwa-id help ``` See [DIDAuth Integration Guides](/guides/did-auth) for both agent flow and backend verification middleware. ## Quick Start ```ts theme={null} import { IdentityKit, DIDAuth, KeyType } from '@nuwa-ai/identity-kit'; const env = await IdentityKit.bootstrap({ method: 'rooch', vdrOptions: { rpcUrl: 'https://test-seed.rooch.network' } }); const kit = await env.loadDid('did:rooch:0xYourDid'); await kit.addVerificationMethod({ keyType: KeyType.ECDSA_SECP256K1 }, ['authentication']); const sig = await DIDAuth.v1.createSignature({ operation: 'call', params: { ts: Date.now() } }, env.keyManager, kit.getDIDDocument().verificationMethod![0].id); const authz = DIDAuth.v1.toAuthorizationHeader(sig); ``` ## IdentityKit (Static) ### bootstrap Prepare VDR(s) and a KeyManager without creating a DID. **Inputs** Bootstrap options DID method to register with VDR VDR-specific options (e.g., rpcUrl, network) Custom key store implementation **Returns** Environment with VDRRegistry and KeyManager ### fromExistingDID Resolve a DID and bind an IdentityKit instance to it. **Inputs** DID to resolve (e.g., did:rooch:0x...) Used for publishing changes and signing **Returns** Instance bound to the DID ### fromDIDDocument Create an instance using a known DID Document. **Inputs** Pre-resolved DID Document Signer for publishing **Returns** Instance bound to the doc ### createNewDID Create and publish a new DID via registered VDR. **Inputs** DID method (e.g., rooch) VDR-specific creation payload Signer for publishing Optional VDR params **Returns** Instance bound to new DID ## IdentityEnv ### loadDid Load an existing DID using the environment. **Inputs** DID to load Defaults to env.keyManager **Returns** Instance bound to DID ### fromDocument Bind a known DID Document. **Inputs** Known DID Document Defaults to env.keyManager **Returns** Instance bound to doc ### createDid Create a DID via the underlying VDR. **Inputs** DID method name Creation payload Override signer VDR-specific options **Returns** Instance bound to new DID ## IdentityKit (Instance) ### addVerificationMethod Add a verification method to the DID Document and publish. **Inputs** Key material and metadata Defaults to `key-<timestamp>` e.g., EcdsaSecp256k1VerificationKey2019 Defaults to DID Public key One or more of authentication/assertionMethod/keyAgreement/capabilityInvocation/capabilityDelegation Optional signing controls Signing key with capabilityDelegation Optional scopes **Returns** New verification method id ### removeVerificationMethod Remove a verification method and update relationships. **Inputs** Verification method id to remove Signing key (capabilityDelegation) **Returns** True if removal published ### updateVerificationMethodRelationships Add/remove relationships for an existing key. **Inputs** Verification method id Relationships to add Relationships to remove Override signer **Returns** True if update published ### addService Publish a new service entry to the DID Document. **Inputs** Service definition Arbitrary fields Signing key (capabilityInvocation) **Returns** Fully qualified service id ### removeService Delete a service by id and publish. **Inputs** Service id to remove Signing key (capabilityInvocation) **Returns** True if removal published ### getDIDDocument Return the current DID Document. **Inputs** No input parameters **Returns** Latest resolved DID Document ### findServiceByType Find a service by its type. **Inputs** Service type string **Returns** Matching service (if any) ### findVerificationMethodsByRelationship List verification methods for a given relationship. **Inputs** Relationship key **Returns** Matching verification methods ### canSignWithKey Check if the signer has the private key for keyId. **Inputs** Verification method id **Returns** True if signer can sign ### getAvailableKeyIds List available key ids by relationship present in both DID doc and signer. **Inputs** No input parameters **Returns** Map of relationships to key ids ## DIDAuth.v1 ### createSignature Create a signed object suitable for DIDAuth v1. **Inputs** Operation payload Signing interface Verification method id Optional signing controls **Returns** Signed object ### toAuthorizationHeader Serialize a signed object into an Authorization header value. **Inputs** Signed object **Returns** DIDAuthV1 \ ### verifyAuthHeader Verify a DIDAuth header string. **Inputs** Authorization header value DID resolver Verification options Seconds Replay protection **Returns** Detailed verification result (ok, error?, errorCode?, signedObject?) ### verifySignatureDetailed Verify a signed object using a resolver or a DID Document. **Inputs** Signed object Source for public key Verification options **Returns** Detailed verification result (ok, error?, errorCode?, signedObject?) ### verifySignature Backward compatible boolean verification. **Inputs** Signed object Source for public key Verification options **Returns** True if signature is valid