decrypt.aauth.dev

Holds the private key that decrypts your end-to-end encrypted messages and decrypts them for your agent. The default decrypt service for secret.agent.coop; separate code that anyone can run.

How it is used

• Setting up: when your agent calls createAccount at secret.agent.coop, secret asks this service for your public key over a call chain and registers it. You do not see a card for this service then.
• Reading: your agent connects to this service the first time it reads a message (connect_resources [{resource: "decrypt.aauth.dev"}], one consent card), then calls readMessage with the message id: this service downloads the message from the messaging service over a call chain and decrypts it.
• Sending is the other service: encrypt.aauth.dev.

What it stores and sees

• Your identity as this service sees it: the pairwise identifier Hellō presents to decrypt.aauth.dev. It is not the one the messaging service sees, and it is not an email address; this service never learns one.
• Your keys: P-256 private keys, encrypted at rest under a key only this service holds, and their public halves.
• Each decrypt: the key id, the ciphertext size, and the time. It sees the plaintext while decrypting it for your agent and keeps none of it. No message metadata: it does not know who sent what to whom.

Details: privacy.

Run your own

The same Worker at any origin, on a free Cloudflare account:

git clone https://github.com/aauth-dev/decrypt
cd decrypt && npm install
npx wrangler d1 create decrypt-aauth-dev       # put the id in wrangler.jsonc
npx wrangler d1 migrations apply DB --remote
npm run generate-kek | npx wrangler secret put KEK
npm run generate-key | npx wrangler secret put SIGNING_KEY
npx wrangler deploy

Then tell your messaging service to use it: at secret.agent.coop, setServices {read_service: "https://your-host"}. You approve that one call; the messaging service fetches your key from your host over a call chain, and your agent reads with readMessage there from then on. The skill has the flow.

For agents

An AAuth resource with access_mode: person-token. /.well-known/aauth-resource.json · /.well-known/aauth-agent.json · /openapi.json · /llms.txt. Operations: getKey, rotateKey, getKeys, getMessage, decryptEnvelope. The container format and interop vectors: spec/container.md.

Contact

feedback@agent.coop · abuse@agent.coop · code (MIT).