Identity

This is the page that connects the phone in your hand to the agent on your machine. It is worth reading in order, because each step depends on the one before.

1 · An email address

Everything begins here. Your email is not a login — it is what your identity is derived from, which is why nobody else can end up with a name in your space.

2 · A vault

Registered against that email, unlocked by a password you set, held on your phone in the Authenticator.

The vault is you. Agents do not have vaults; people do.

3 · A resource — assigned to your vault

A vault holds resources. This is the step people find surprising: a resource is assigned to your vault. The vault is what identifies the owner, so every agent has a provable person behind it rather than being an anonymous piece of software.

Two kinds.

Generic resource

The platform derives the name from your email:

web0-still-copper-lake18
└──────┬───────┘ └──┬──┘
  always yours     varies

The first three words are fixed for your email address — the same every time. The fourth comes from a list and changes per issuance.

So names cannot be squatted. They are not first-come-first-served: the prefix belongs to your address, and nobody else can ever be issued a name in your space. Once you use one it is yours.

Nothing to set up. This is the normal choice.

Domain resource

A name on a domain you control — agent01.yourcompany.com.

Your vault’s email must be on that domain. A vault at [email protected] can create agent01.yourcompany.com. A vault on any other domain cannot; the platform refuses. You cannot claim a domain you have no address at.

Adding it returns a DNS TXT record to publish. That record is the proof.

The TXT record is checked at licence time, not creation time

You can add the resource without the record — it simply will not become a working identity. When you approve a licence, the platform checks DNS. No record, no licence. An unproven claim sits there doing nothing.

Use a domain resource when the name matters to whoever is calling.

4 · A licence

An agent needs one. During the install, hexaeight-activate newtoken asks for the resource name — the one from step 3 — and the licence code from your email, then shows a QR code.

You scan it in the Authenticator and approve. For a domain resource, DNS is verified at this moment.

You license agents, not people. Once the agent is running, an unlimited number of your users can authenticate against it at no cost.

5 · A running agent

Two files land in the folder: env-file and hexaeight.mac. The agent now holds that resource’s identity, and from here on it can prove who it is to anybody.

hexaeight.mac is machine-bound

Never copy it to another machine — that breaks the identity. To share one licence between programs on the same machine, hardlink it.

6 · And now it can talk to anyone

This is where Dead Drop Encryption starts, and where the work above pays off.

Because the agent has an identity, it can derive a shared key with any other identity — with no introduction, no exchanged keys, and no certificate.

All three work. The third is the one worth pausing on: you can encrypt to [email protected] today, when that person has never heard of HexaEight, and they can read it after they register.

The recipient’s identity does not need to exist when you encrypt. It needs to exist when they decrypt.

How the pieces relate

	Belongs to	What it is for
Email	You	What your identity is derived from
Vault	You, on your phone	Holds resources, approves things
Generic resource	Assigned to your vault	An identity for an agent, name derived from your email
Domain resource	Assigned to your vault	The same, but on a domain you have proved you own
Agent token	Assigned to your vault	Lets a browser app authenticate to your agent
Licence	A machine	Permits one agent to run there
Agent	A machine	Holds a resource’s identity, and proves it per message

Next

• The Authenticator — the app, screen by screen
• Dead Drop Encryption — what identity lets you do
• Installing — do all of this for real