Skip to main content

arc did

arc did manages identity and trust: generating a DID identity, issuing and verifying verifiable credentials, and managing which issuers you trust.

arc did manages identity and trust: generating a DID identity for yourself, a provider, or a blocklet; issuing and verifying verifiable credentials; and managing the list of issuers you trust.

Captured against arc 2.0.0-beta.50 (commit a99fb2c37, main, 2026-09-11). Run arc --version before you copy dumps; the commit is what pins the command surface.

bash
arc did <subcommand> [options]

Global flags (see Overview): --json, --view, --instance / -i (which local ARC instance; omit for default), and --home (instance root; to pick which instance, use --instance). arc did init --home is one of the places --home creates identity at a chosen root.

Identity

arc did init

Generate a DID identity.

Usage

bash
arc did init [options]
  • --developer: generate a developer root key (ROLE_ACCOUNT)
  • --provider: derive a provider DID from the developer key (ROLE_PROVIDER)
  • --blocklet: derive a blocklet DID from the developer key (ROLE_BLOCKLET)
  • --force: overwrite an existing identity

Without any of --developer/--provider/--blocklet, it auto-detects which kind to generate based on where you run it.

arc did info

Show identity and credential info.

bash
arc did info

Example (run outside a recognized project)

bash
$ arc did info
ERROR: No entity manifest found in current directory (looked for blocklet.yaml, .aup/, index.html, index.{txt,md,ans}, package.json)

Example (run inside a project that has an identity and an issued credential)

bash
$ arc did info
acme-widget DID=z2qaHJMfMAjP3t1eooziSUa6n7v25AbyfH4G1 CREDENTIAL=true ISSUER=z2qaHJMfMAjP3t1eooziSUa6n7v25AbyfH4G1

arc did check

Run conformance tests for the current provider.

bash
arc did check

arc did list

List identities stored in this instance home — reads whatever identity files are on disk; no running daemon is required. Captured against arc 2.0.0-beta.48 (commit 5a5316bde, main, 2026-09-10).

bash
arc did list [options]

Example (fresh home, nothing generated yet)

bash
$ arc did list --home /tmp/arc-did-doc-home
No identities

Example (after arc did init --developer)

bash
$ arc did init --developer --home /tmp/arc-did-doc-home
CREATED developer:developer DID=z1kExiHjGkUcBe6YTpyspLLNy1wb2vfCsV2
Next: arc did list --home /tmp/arc-did-doc-home
$ arc did list --home /tmp/arc-did-doc-home
developer DID=z1kExiHjGkUcBe6YTpyspLLNy1wb2vfCsV2 TYPE=developer

--home points straight at a folder on disk. --instance / -i instead resolves through the instance registry (arc service list); did list itself never needs a running daemon, but the name still has to be one you actually created:

bash
$ arc did list -i doc519-nonexistent
ERROR: no instance named "doc519-nonexistent". `arc service list` shows 5

Exit 1. (The number after shows is how many instances this machine had at capture time — it says nothing about the name you typed.) A real instance works whether its daemon is running or stopped — arc service start already generated it a developer identity, which is why the first did list against a fresh instance is not empty the way a bare --home folder is:

bash
$ arc service start -i doc519didlist --home /tmp/arc-doc519-instance-home --port 0
...
  Status:   up
$ arc did list -i doc519didlist
developer DID=z1jhrDL9b5Et2jgSZJwPkL324R4aVaXBHbf TYPE=developer
$ arc service stop -i doc519didlist
Service stopped: doc519didlist
$ arc did list -i doc519didlist
developer DID=z1jhrDL9b5Et2jgSZJwPkL324R4aVaXBHbf TYPE=developer

(splash banner lines omitted from the service start/service stop output above.) --json returns the same rows as structured data:

bash
$ arc did list -i doc519didlist --json
{
  "identities": [
    {
      "name": "developer",
      "did": "z1jhrDL9b5Et2jgSZJwPkL324R4aVaXBHbf",
      "entityType": "developer"
    }
  ],
  "total": 1,
  "hintSelector": "-i doc519didlist"
}

Credentials

arc did issue

Issue a verifiable credential.

Usage

bash
arc did issue [options]
  • --skip-check: skip the conformance check
  • --counter-sign: counter-sign an existing VC with a trusted issuer key
  • --issuer-key <path>: path to the issuer key file, used with --counter-sign
  • --expiration <date>: expiration date, ISO format
  • --all: issue VCs for all entities (providers + blocklets)
  • --trust: auto-register the issuer as trusted after counter-signing

arc did verify

Verify a credential.

bash
arc did verify

Trusted issuers

arc did issuer manages the list of issuers your setup trusts.

bash
arc did issuer <subcommand> [options]

arc did issuer list

List all trusted issuers.

Example

bash
$ arc did issuer list
No trusted issuers

arc did issuer add

Add a trusted issuer.

Usage

bash
arc did issuer add <name> [options]
  • --name <name> (required): issuer identifier, used as filename prefix
  • --from-key <path>: path to a key file containing DID and public key
  • --from-file <path-or-url>: path or HTTPS URL to a .did.json file
  • --from-vc <path>: path to a VC file, extracts the counter-sign proof signer
  • --proof-index <n>: select a specific proof by index, for --from-vc with multiple proofs
  • --did <did>: DID address, base58 z... format
  • --pk <key>: public key, hex format

arc did issuer remove

Remove a trusted issuer.

bash
arc did issuer remove <name>

arc did issuer inspect

Show detailed information about a trusted issuer.

bash
arc did issuer inspect <name>

arc did issuer reset

Reset the trust store: remove manually-added issuers. This build has no shipped seed set to restore — on a clean home the command is a no-op.

Usage

bash
arc did issuer reset [options]
  • --yes: skip the confirmation prompt (required when stdin is not a TTY)

Example (clean home)

bash
$ arc did issuer reset --yes
RESET no-op

$ arc did issuer list
No trusted issuers

--help still says "restore shipped seeds"; that one-liner does not match this build. --json reports {"removed":[],"restored":[]}. After you add an issuer, the same --yes command prints REMOVED <name> and arc did issuer list again reports No trusted issuers.