larzid

Decentralized identity & verifiable credentials in pure Python.

Self-certifying identities and signed, checkable claims — with no blockchain, no central registry, and no certificate authority. An identity is an Ed25519 keypair whose DID (did:larz:<pubkey>) literally contains its public key, so anyone can verify its signatures from the DID alone. Issuers sign credentials about subjects that anyone can verify offline.

from larzid import Identity, Credential

issuer  = Identity.generate()
subject = Identity.generate()

# issue a signed, expiring claim about the subject
cred = Credential.issue(issuer, {"role": "admin"},
                        subject=subject.did, expires_in=3600)

cred.verify(issuer.did)      # True — signature + expiry checked, offline

Why

• Self-certifying. The DID carries the public key, so verification needs nothing external — no ledger lookup, no CA, no callback to the issuer.
• Real signatures. Ed25519 via larzcrypt (itself pure Python). Tamper with a credential and verification fails.
• Offline-verifiable credentials. Issue a claim once; anyone can check who signed it, that it's unmodified, and that it hasn't expired — without talking to the issuer.
• Safe by construction. Public-only identities (from a DID) can verify but can't sign; to_dict() never leaks the secret; bad input returns False instead of throwing.

Install

pip install larzid

Identities

from larzid import Identity

alice = Identity.generate()
alice.did                     # "did:larz:3b6a08...f1"  (self-certifying)
sig = alice.sign(b"hello")    # hex signature
Identity.verify(alice.did, b"hello", sig)     # True

# persist / restore an identity by its secret seed (back this up securely!)
seed = alice.export_secret()  # 64 hex chars
alice = Identity.from_secret(seed)

# a verify-only identity from just a DID
watcher = Identity.from_did(alice.did)
watcher.can_sign              # False

Verifiable credentials

An issuer attests to some claims about a subject and signs them. The credential is a self-contained object anyone can verify.

from larzid import Identity, Credential

issuer, subject = Identity.generate(), Identity.generate()

cred = Credential.issue(
    issuer,
    {"role": "admin", "org": "acme"},
    subject=subject.did,
    expires_in=86400,
)

cred.verify(issuer.did)       # True
cred.claims                   # {"role": "admin", "org": "acme"}
cred.is_expired()             # False

# hand it over the wire and verify on the other side
wire = cred.to_json()
Credential.from_json(wire).verify(issuer.did)

Verification checks the issuer's signature, optionally that it came from the issuer you expect, and that it hasn't expired — all offline.

Use it for

Service-to-service auth, API tokens you can verify without a database, capability grants ("this DID may do X until T"), attestations, and anything blockchain-adjacent — it's the natural identity layer for larzchain.

Scope

larzid gives you identities and signed credentials. It deliberately doesn't include revocation lists, selective disclosure, or a DID resolver network — those are layers you can build on top. What's here is the cryptographic core, done simply and correctly.

Tests

python -m unittest discover -s tests -v      # 19 tests, incl. tamper/expiry/forgery

The Larz stack

Pure-Python, zero-third-party-dependency building blocks:

• larz — money-native web framework
• larzchain — from-scratch PoW blockchain
• larzmoney — exact, penny-perfect money
• larzcrypt — pure-Python cryptography toolkit
• larzdb — crash-safe embedded database
• larzagent — zero-dep AI agent framework
• larzchart — data to inline SVG charts
• larzmark — Markdown + SEO static sites
• larztask — durable background job queue
• larzvault — encrypted secrets manager
• larzvm — deterministic gas-metered VM
• larzcache — LRU/TTL/tiered caching
• larzvalidate — schema validation
• larzid — this library

License

MIT © larz-scripter