HexaEight Documentation

Every party — a person, an agent, a service — gets a cryptographic identity. Every message between them is encrypted end to end and proves who sent it. Nothing in the middle can read it, and nothing in the middle has to be trusted.

No API keys. No certificates. No directory to look anyone up in.

You do not have to install this by hand

The install guide is written for an AI agent. Give any CLI coding agent this one line and it does the whole thing, checking each step:

Install HexaEight on this machine by following https://www.hexaeight.com/llms-install.txt — read it first, tell me which OS section applies, and ask me for the licence code and the provider API key before you start.

Two things it will ask you for, because nothing else can do them: the licence (a code plus a QR approval on your phone) and a provider API key. See Install with an agent, or Installing for the same procedure by hand, per operating system.

Or step through it yourself — in order

Do these in sequence. Each is testable on its own, and each depends on the one before it.

0	Before you begin	a machine, .NET, the app on your phone, a licence
1	Your identity starts on your phone	your email becomes a cryptographic identity
2	Install your agent identity	bind it to a machine; an agent exists
3	Connect a model	a router holds the keys; the agent starts
4	Connect the workspace	you get a browser interface to it
5	Your first conversation	confirm the whole path works

About twenty minutes. At the end you have an agent that answers you, and nothing else is configured — which is the point. Everything after this is something you add on purpose.

Then add what you need

These are independent. Read the one you want; skip the rest.

Let it search your documents	Documents
Put an API you already run behind it	An existing API
Make it follow a procedure, every time	A procedure it follows
Run your existing agent framework behind it	Your framework already works
Let your own users in — unlimited, free	Your own users
Let another system call it	Other software calling it

Model access

Step 3 gives you the short version. There are two ways to run it, and the difference matters commercially as much as technically.

You hold the provider keys	Run your own router
Someone else holds them, and you keep your customer list private	Forward to an external router

Concepts

Not needed to get started. Worth reading once something is running.

The problem this solves	Why this exists
The parts, one at a time	Components
Who gets an identity, and what it is bound to	Identity
The app your identity lives in	The Authenticator
The encryption underneath	Dead Drop Encryption
How the parts fit together	Architecture
Why nothing works until you permit it	Trust and permission
How this differs from tokens	Why not OAuth
What an auditor will ask	Compliance
Every term in one place	Glossary

Operating it

Who may do what	Policy
Start, stop, upgrade, revoke	Lifecycle
How much one machine serves	Capacity
What an error message means	Troubleshooting
Every command	hexaeight-activate
Every setting, and which file it goes in	Settings

A note on what this is not

This is not a framework you write your agent in. You keep whatever you already have — a Python service, a REST API, an existing agent framework — and HexaEight puts an identity and a policy boundary around it.

The agent is the integration surface. Calling one is an authenticated request in and an answer out, in any language — there is no SDK to adopt for that. Putting your own code behind an agent is a process the agent runs, declared with its argv and reply fields — also language-agnostic; see Bring your own engine.

The one place a client library helps is alt-auth in a browser, which does real cryptography on the page — see Your own users.