Identities

Identities keys are the digital IDs that identify actors. You can think of actors identity keys as users authentication credentials. But hey, DefraDB is a discrimination-free database – who says that users are the only entities acting on the database? Whales act too.

In DefraDB, identity keys are hex-encoded, of type either secp256k1 or ed25519. The keys authenticate all CLI/HTTP requests when Document Access Control or Node Access Control is enabled.

Generate identities

Generate a new identity with the CLI command defradb identity new. You will need the PrivateKey to authenticate in CLI commands and HTTP requests, whereas the DID key is the identity's public identifier.

defradb identity new

{
  "PrivateKey": "b17a7b973f629b900cf23654db9c4be935f90281707dd3e2cd7a56bdd2c1bf4f",
  "PublicKey": "0363f224bfddb641bd0cd4b5409bc921c405460727f864f6dba33da5dd7b061bcf",
  "DID": "did:key:z7r8oqUcSm6xwwxfpBZ5R6CWQiPRnYpXouwgeXkbWgVcWBF19QDndBBWzgHcvvHhaUe7qcTz7ayJVXksND37rvV7GAUAv",
  "KeyType": "secp256k1"
}

Retrieve node identity

When you start a node for the first time, an identity is automatically created (from which the node's private keys are derived). You can extract both public and private keys on an existing node.

Public key

CLI

Retrieve a node's identity with the CLI command defradb client node-identity. The node must be online.

defradb client node-identity

{
  "PublicKey": "0363f224bfddb641bd0cd4b5409bc921c405460727f864f6dba33da5dd7b061bcf",
  "DID": "did:key:z7r8oqUcSm6xwwxfpBZ5R6CWQiPRnYpXouwgeXkbWgVcWBF19QDndBBWzgHcvvHhaUe7qcTz7ayJVXksND37rvV7GAUAv"
}

HTTP API

Retrieve a node's identity by submitting a GET request to the HTTP endpoint /node/identity. The request doesn't need to be authenticated. The node must be online.

GET http://localhost:9181/node/identity HTTP/2
accept: application/json

{
  "PublicKey": "0363f224bfddb641bd0cd4b5409bc921c405460727f864f6dba33da5dd7b061bcf",
  "DID": "did:key:z7r8oqUcSm6xwwxfpBZ5R6CWQiPRnYpXouwgeXkbWgVcWBF19QDndBBWzgHcvvHhaUe7qcTz7ayJVXksND37rvV7GAUAv"
}

Private keys

List a node's available private keys with the CLI command defradb keyring list. The keyring is sourced from the default root directory, unless a different path is given with the option --rootdir.

List available private keys

defradb keyring list

Keys in the keyring:
- encryption-key
- node-identity-key
- peer-key
- searchable-encryption-key

Retrieve any of the listed private keys with the CLI command defradb keyring get <key-name>. The node doesn't have to be online, but the keyring's secret must be provided.

Export the node's peer-key

defradb keyring get peer-key

0b0201e3c3f15aa4cd2a0d8e287f2d6a38d644474898268e89fd43d67540758214a2b8208c315d3cab9d3f73071213e2ccd17bd64b48b67e2610a94a7971c5c5