Create Passport

Overview

Create a cryptographically-anchored Passport identity. Every human on HUMΛN has a unique DID (Decentralized Identifier) bound to their devices and controlled by cryptographic keys they own.

What is a Passport?

The HUMΛN Passport is:

Cryptographically controlled - Your identity is proven by keys you control
Device-rooted - Keys never leave your secure enclave / platform authenticator
Portable - Works across apps, devices, and platforms
Human-owned - HUMΛN cannot access or revoke your identity

Format: did:human:<uuid>
Example: did:human:550e8400-e29b-41d4-a716-446655440000

Human Passports are minted on-device via WebAuthn, then registered with the API. There is no server-side Passport.create() that invents keys for you.

SDK Examples

SDK:

REST API Example

POST /v1/passports/webauthn/options
Content-Type: application/json

{
  "name": "Alice Developer",
  "personType": "Human"
}

POST /v1/passports
Content-Type: application/json

{
  "did": "did:human:550e8400-e29b-41d4-a716-446655440000",
  "name": "Alice Developer",
  "personType": "Human",
  "webauthn": {
    "registrationId": "<from options response>",
    "credential": {}
  }
}

Cryptographic Details

Algorithm: Ed25519 / platform authenticator (WebAuthn)
Key storage: Device secure enclave / platform authenticator — private material never leaves the device
Library: @human/passport (PassportAuth.mint)

Use Cases

User Onboarding

New users mint their Passport as part of sign-up - Passport becomes their permanent identity across all HUMΛN apps

Enterprise SSO

Employees mint Passports linked to company directory - Single identity for all internal agents and tools

Multi-Device Setup

Mint Passport on primary device - Enroll additional devices via device ceremony

AI Agent Identity

Org/agent Passports are created via API after human founders authenticate - Agents prove identity cryptographically in workflows

Security Considerations

DO

Mint Passports via WebAuthn so keys stay on-device

Use PassportAuth / Console for the ceremony — do not invent server-side key APIs

Enable multi-device enrollment for resilience

Set up recovery guardians per Passport recovery patterns

DON'T

Never expose private keys in logs or error messages

Don't treat human login as Passport create — login assumes an existing Passport

Don't create Passports without user consent

Next Steps

Delegate Access - Grant an agent access to act on your behalf
Login with Passport - WebAuthn login → delegation JWT
Multi-Device Sync - Enroll additional devices