decrypt.aauth.dev

Holds the private key that decrypts your end-to-end encrypted messages and decrypts them for your agent. The default decrypt service for secret.agent.coop; separate code that anyone can run.

How it is used

• Setting up: when your agent calls createAccount at secret.agent.coop, secret asks this service for your public key over a call chain and registers it. You do not see a card for this service then.
• Reading: your agent connects to this service the first time it reads a message (connect_resources [{resource: "decrypt.aauth.dev"}], one consent card), then calls decryptEnvelope with the ciphertext it fetched from the messaging service.
• Sending is the other service: encrypt.aauth.dev.

What it stores and sees

• Your identity as this service sees it: the pairwise identifier Hellō presents to decrypt.aauth.dev. It is not the one the messaging service sees, and it is not an email address; this service never learns one.
• Your keys: P-256 private keys, encrypted at rest under a key only this service holds, and their public halves.
• Each decrypt: the key id, the ciphertext size, and the time. It sees the plaintext while decrypting it for your agent and keeps none of it. No message metadata: it does not know who sent what to whom.

Details: privacy.

Run your own

The same Worker at any origin, on a free Cloudflare account:

git clone https://github.com/aauth-dev/decrypt-agent-coop
cd decrypt-agent-coop && npm install
npx wrangler d1 create decrypt-agent-coop      # put the id in wrangler.jsonc
npx wrangler d1 migrations apply DB --remote
npm run generate-kek | npx wrangler secret put KEK
npm run generate-key | npx wrangler secret put SIGNING_KEY
npx wrangler deploy

Then tell your agent to use it: connect_resources your host, getKey there, and register the key at your messaging service (secret.agent.coop addKey). The messaging service does not need to know where the private key lives. You can also skip a service entirely and keep the key on your own machine; the skill has the scripts.

For agents

An AAuth resource with access_mode: person-token. /.well-known/aauth-resource.json · /.well-known/aauth-agent.json · /openapi.json · /llms.txt. Operations: getKey, rotateKey, getKeys, decryptEnvelope. The container format and interop vectors: spec/container.md.

Contact

feedback@agent.coop · abuse@agent.coop · code (MIT).

This host moved from decrypt.agent.coop on 2026-09-14. The old host redirects here; keys registered under it were re-created.