Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 157 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
Keep is the official user interface implementation for the KERI (Key Event Receipt Infrastructure) protocol and ACDC (Authentic Chained Data Container) ecosystem. Developed by the WebOfTrust organization, Keep serves as a task-oriented frontend application that provides accessible tools for managing decentralized identities, credentials, and cryptographic operations within the KERI ecosystem.
Keep follows a client-server architecture where:
This separation allows for:
While the source documents don't specify Keep's implementation language explicitly, the architecture indicates it's a web-based application that:
Key Material Isolation: Keep's architecture ensures that private keys never leave the keripy agent. All cryptographic operations (signing, key generation, rotation) occur server-side in the agent, with Keep only sending operation requests and receiving results. This prevents key exposure to the browser environment and follows security best practices for web-based identity applications.
Authentication Flow: Keep authenticates to the keripy agent using passcodes that unlock encrypted keystores. The passcode is used to decrypt the keystore in the agent's secure environment, enabling the agent to access private keys for signing operations. Session management maintains authenticated state without repeatedly transmitting the passcode.
Asynchronous Operations: Multi-signature operations in Keep are inherently asynchronous because participants may be geographically distributed and sign at different times. Keep must handle partial signature states, display progress to users, and coordinate with the keripy agent's escrow mechanisms that temporarily store incomplete multi-sig events until threshold satisfaction.
OOBI-Based Discovery: Participants in multi-sig groups discover each other through OOBIs (Out-Of-Band Introductions). Keep provides interfaces for generating OOBIs (which can be shared as URLs, QR codes, or through other channels) and resolving OOBIs received from other participants. This discovery mechanism enables decentralized coordination without requiring a central registry.
IPEX Protocol Integration: Keep implements the IPEX (Issuance and Presentation Exchange) protocol for credential exchange. IPEX provides negotiation protocols that allow issuers and holders to coordinate credential issuance, including support for both solicited (holder requests credential) and unsolicited (issuer offers credential) issuance patterns. Keep's UI guides users through these negotiation flows.
Registry Integration: Credentials issued through Keep are tracked in TEL (Transaction Event Log) registries. Keep queries these registries to check credential status (issued, revoked, suspended) and updates registries during issuance and revocation operations. The system supports both public registries (where status is openly queryable) and blinded registries (where status is only revealed to authorized parties).
Governance Framework Adherence: For vLEI use cases, Keep implements workflows that comply with the vLEI Ecosystem Governance Framework. This includes supporting required credential types (QVI, Legal Entity, OOR, ECR), enforcing credential chaining rules (e.g., OOR credentials must chain to Legal Entity credentials), and validating against official vLEI schemas hosted by GLEIF.
Keep is not a protocol specification but rather a reference implementation of a KERI client application. It demonstrates how to:
Keep enables users to establish and manage individual self-certifying identifiers:
A core capability is managing group identifiers controlled by multiple parties:
This functionality is critical for organizational use cases where multiple parties must collectively control an identifier, such as:
Keep provides comprehensive verifiable credential management:
Issuance:
Revocation:
Presentation:
Keep is specifically designed to support the vLEI (verifiable Legal Entity Identifier) Ecosystem developed by GLEIF (Global Legal Entity Identifier Foundation):
While Keep itself doesn't store keys, it provides interfaces for managing the underlying keystore:
The source documents provide limited installation details, but the general setup process involves:
Keep configuration typically involves:
Keep supports multiple deployment scenarios:
Keep consumes the keripy agent REST API, which provides endpoints for:
Identity Operations:
POST /identifiers - Create new AIDsGET /identifiers/{aid} - Retrieve AID informationPOST /identifiers/{aid}/rotate - Perform key rotationPOST /identifiers/{aid}/interact - Create interaction eventsCredential Operations:
POST /credentials - Issue new credentialsGET /credentials/{said} - Retrieve credential detailsPOST /credentials/{said}/revoke - Revoke credentialsGET /registries/{registry}/credentials/{said} - Check credential statusMulti-Signature Operations:
POST /multisig/inception - Initiate multi-sig AID creationPOST /multisig/join - Join existing multi-sig groupPOST /multisig/rotate - Coordinate multi-sig rotationSingle-Signature AID Creation:
Multi-Signature AID Creation:
Credential Issuance:
Signify Browser Extension:
Keep integrates with the broader KERI ecosystem:
Key Material Isolation:
Authentication:
Asynchronous Operations:
OOBI-Based Discovery:
IPEX Protocol:
Registry Integration:
Governance Compliance:
Identity Assurance:
Agent Architecture:
Witness Coordination:
To effectively use and understand Keep, users should be familiar with:
Core KERI Concepts:
Credential Concepts:
Advanced Features:
vLEI Ecosystem (for vLEI use cases):
Keep represents the reference user interface implementation for KERI-based identity management, providing accessible tools for managing autonomic identifiers, credentials, and multi-signature operations. By leveraging the keripy agent backend, Keep maintains security while offering a user-friendly interface for complex cryptographic operations. Its specific focus on the vLEI ecosystem demonstrates KERI's applicability to real-world organizational identity use cases, while its architecture provides a model for building KERI client applications across various deployment scenarios.
Identity Assurance Integration: vLEI credentials require identity verification before issuance. Keep provides interfaces for identity assurance workflows, integrating with QVI (Qualified vLEI Issuer) processes and supporting the designation of authorized representatives who can request credential issuance on behalf of legal entities.
Agent-Based Scaling: Keep's reliance on the keripy agent backend enables horizontal scaling. Multiple Keep instances can connect to the same agent, and agents can be deployed in clustered configurations for high availability. The agent handles resource-intensive cryptographic operations, allowing Keep to focus on UI/UX concerns.
Witness Coordination: Witness operations are asynchronous, and Keep must handle potential delays in witness responses. The UI provides feedback on witness receipt status, showing users when threshold satisfaction is achieved. For multi-sig operations, this coordination becomes more complex as both participant signatures and witness receipts must be collected.