Verified Agent Identity

• Agent-to-human ownership linking — You want to formally bind an AI agent's DID to a verified human owner using on-chain attestation registries.
• Challenge-response authentication — Your workflow requires an agent to prove it controls a specific DID by signing a nonce or structured challenge.
• Verifying another party's identity — You need to confirm that a user or agent genuinely owns a DID before granting access or taking action.
• Decentralized identity management — You are building multi-agent systems where each agent needs a persistent, portable, self-sovereign identity stored locally.

• If you need a traditional OAuth / API-key-based auth flow rather than DID-based cryptographic identity, this skill is not the right fit.
• If your use case does not involve the Billions Network — the DIDs and attestations created here are specific to did:iden3:billions:main and are not interchangeable with other DID methods without additional tooling.

Generate new Ethereum-based decentralized identifiers on the Billions Network with createNewEthereumIdentity.js, either from a fresh random key or an existing private key. All identities are stored locally and one is designated as the default.

Use linkHumanToAgent.js to sign a challenge and register ownership in both the Billions ERC-8004 Registry and the Attestation Registry. Human uniqueness is verified before the attestation is created, ensuring one human per agent link.

generateChallenge.js creates a random nonce tied to a DID, and verifySignature.js validates the resulting JWS token — enabling standard cryptographic proof of DID ownership in any agent-to-agent or user-to-agent flow.

All identity data lives in $HOME/.openclaw/billions. When BILLIONS_NETWORK_MASTER_KMS_KEY is set, private keys in kms.json are encrypted at rest; without it they are stored in plaintext, so the env key is strongly recommended for production use.

The skill enforces a rigid execution order: it checks for an existing identity before any linking operation, halts on any script error, and explicitly prohibits manual cryptographic workarounds or direct file manipulation — preventing accidental key exposure or mis-configuration.

After deploying a new agent, run createNewEthereumIdentity.js to generate its DID, then call linkHumanToAgent.js with the agent's name and description as the challenge. The agent is now registered on-chain with an attestation proving which human owns it.

When two agents need to establish trust, one agent generates a challenge via generateChallenge.js, the other signs it with signChallenge.js, and the first validates the token with verifySignature.js — confirming DID ownership before any privileged operation proceeds.

In workflows where multiple agents share JWT tokens for session continuity, this skill provides the underlying identity layer — each token is anchored to a verifiable DID, so downstream agents can confirm the token's origin is authentic.