Launching today

HelixID

Launching today

Open-source identity & trust layer for AI agents

14 followers

Open-source identity & trust layer for AI agents

14 followers

Visit website

HelixID is an open-source identity layer for AI agents. Most agent-auth tools stop at session-level access i.e. a token that gets an agent through one app, one time. HelixID goes further: every agent gets a W3C Verifiable Credential and DID, so its identity, authority, and actions can be proven across organizations, offline, and after the fact. Enforced with OPA/Rego, composes with your existing OAuth, self-hostable in 5 minutes. Apache 2.0, no vendor lock-in.

Free Options

Launch tags:Open Source•Developer Tools•Artificial Intelligence

Launch Team / Built With

Agent Builder by AirtopWeb agents that heal themselves.

Promoted

Beagle Security

Maker

📌

Hey Product Hunt 👋 We built HelixID because we kept hitting the same wall while building multi-agent systems: OAuth is great at getting an agent through one door, in one app, for one session. But the moment an agent needs to act across organizations, delegate a task to another agent, or prove after the fact what it did and on whose authority, the token runs out of road. There's no standard way to answer "who is this agent, who authorized it, and what was it actually allowed to do?" once you're outside a single trust boundary. So instead of building another OAuth wrapper, we went one layer deeper. HelixID issues every agent a Decentralized Identifier and W3C Verifiable Credentials, verifies Verifiable Presentations at the execution boundary, and enforces scope with OPA/Rego, all backed by a tamper-evident audit trail. OAuth is the building pass and HelixID is the passport: it travels with the agent, and it's verifiable even offline. A few things we cared about while building this: Standards over lock-in: W3C VC Data Model v2, DID Core, OPA/Rego. No proprietary format you're stuck with. Composability: this isn't a rip-and-replace. It sits alongside your existing OAuth/OIDC stack (you can exchange a Verifiable Presentation for an OAuth token via RFC 8693). Zero friction to start: npx @helixid/cli init gets you running locally in under 5 minutes, no ledger or external dependency required. Actually open: Apache 2.0, self-hostable, enterprise-legal-friendly (no AGPL headaches). This is very much a v1, and we built it in the open because we think agent identity is a problem the whole ecosystem needs to solve together, not something any one vendor should own. We'd genuinely love your feedback about what breaks, what's missing, and what you'd want it to do that it doesn't yet. Contributions and "good first issue" PRs are welcome on GitHub. Thanks for checking it out! 🙏

Report

6d ago

Maker

I kept hitting the same wall building agent systems: the moment an agent calls a service in another org, or hands work to another agent, the only credential it carries is a static API key. No scope, no expiry, no record of who authorised the action.

HelixID gives each agent a DID and a wallet of Verifiable Credentials instead. It signs a presentation per tool call, the service verifies it before anything executes, and you get back the agent's identity, its scopes, and the delegation chain behind them.

Apache 2.0, self-hosted. JS and Python SDKs, MCP middleware, a LangChain adapter.

Happy to answer anything in the comments. Honestly I'd rather have bug reports than upvotes — if you try it and it breaks, tell me here.

Report

2h ago