NOMOSνόμος
Keys

Contacting the appliance…

nomos.web.setup

Establish your trust anchor.

Enroll a public identity, then prove possession with a NOMOI mandate.

Bootstrap progress

Operator TA IPNS ID
Policy publication
Published policy CID
Administration scope

Progress refreshes while this screen is open. “Observed” means the publication is available. Successful operator sign-in permanently closes password setup.

Operator enrollment

Use the configured bootstrap password. The initial default is nomos.

Use a key from this browser
Public-key algorithm

Export with nomos id export <name>, or create a key in this browser. Only the public identity is submitted; your private key and passphrase stay with you.

Enrolled and published?

Issue your sign-in mandate in this browserContinue to sign in

nomos.web.keys

NOMOI Keyring

Create or import signing keys, keep the mandates issued to them, issue mandates, and answer challenges — all inside this browser. Nothing here is sent to the appliance.

Keys are stored the way the CLI stores them: encrypted under your passphrase, in the same file format. Save each key file — clearing this site's data deletes the browser's copy. A saved key file works as ~/.config/nomos/ids/<name>, and CLI key files import here. Unlocked keys stay in memory only while this tab is open.

Signing keys

Create a key

The passphrase encrypts the key file. Nobody can recover a forgotten one.

Import a key file

  • No keys yet. Add one: create it here, or import a key file from the CLI.

Issue a mandate

review
Subject

Check this before you sign. It is decoded from the exact bytes that will be signed.

Scope
Subject
Signed by
Index
Valid
Trust Anchor
Issuer
Algorithms
Context

Mandate signed and kept in this browser. It is not published: hand the presentation to its subject.

CID

Mandates

  • No mandates yet. Issue one, or add a presentation someone gave you.

Answer a challenge

For another nomos platform, or any verifier that issues a challenge: this is nomos sign in the browser. Paste the nonce it shows and give it back the signature.

Mandate

No mandate in this browser delegates to a key here. Add or issue one under Mandates.

Signature 

          

        

      

    

  




        
Updating workspace…

        
You can read this Trust Anchor's published policy. Editing, publication history, and audit activity require administration or separate action grants.

        

        

  

    
.nomos.web.overview

    
Overview.

  

  

    

    
Root authoritiesIn the published policy

    
Trusted namespacesWhitelist entries

    
Not yet observedIn loaded publications

    
Trust AnchorVerified

  

  

    

      
Published trust policy

      

        

          
Namespace

          
Revision

          
Revocations

          
Published CID

        

        

      

    

    

      
Publications
View activity →

      

      
No publications recorded for this TA.

      

      
A publication is complete when its state is observed. Showing up to five.

    

  

  

    
Audit activity
First recorded changes · oldest first
Full audit history →

    

    
No audit events recorded for this TA.

    
Only reads recorded so far.

    

  




        

  

    
.nomos.web.tas

    
Manage TAs.

    
Each Trust Anchor has its own publishing identity, administrator, and verifier.

  


  

    
    
  


  

    

      

        
TA directory

        

      

      
No Trust Anchors yet
Create one under New TA. Its namespace, state and provisioning progress appear here.

      
    
        
      

      

    

  


  

    

      

        
Create a TA

        

          
          

            
.nomos.web
Administers the new TA.

            
.nomos.web.auth
Signs in to read its published policy.

          

          
Use a key from this browser

          
          

            

            
          

        

        
The key becomes the initial administrator. Retrying reuses its TA and publishing key.

      

      

        
New TA progress

        
Nothing provisioning
Create a TA to follow its provisioning here.

        

          

          
          

          

          

        

      

    

  




        

  

    
.nomos.web.policy

    

    

  


  

    
    
    
    
  


  

    

      

        
Published policy

        

      

      

        

          
Published CID

        

        

          
Root authorities 

            
  • None.

          
Trusted namespaces 

            
  • None.

          
Revocations 

            
  • None.

        

        
Policy details

        
Publication may take time; a job is complete only when its state is observed.

      

    


    

      
Verifier directory
Open verifier ↗

      

        

          
Listed in the public Verifiers menu

          
        

        
The direct verifier URL remains available to anyone who knows it.

      

    

  


  

    

      

        
Policy draft
unsaved changessaved

        
      

      

        

          
No draft open

          
New drafts start from the published policy. Change roots, trusted namespaces and revocations, save, then publish one immutable revision.

          
        

        

      

      

        

          
Root identities
Registered keys that may sign root mandates for this Trust Anchor.

          
A revoked identity is still listed as a root. Remove it from the roots before saving.

          
    
            
            
  • No root identities — nothing could sign for this Trust Anchor.
    • 
          

          

            
            
            
          

          
        


        

          
Trusted namespaces
Other Trust Anchors whose chains this one accepts, each rooted at a scope prefix.

          
    
            
            
  • No trusted namespaces.
    • 
          

          

            
            
            
          

          
        


        

          
Revocations
An identity revocation can be lifted at any time; lifting it does not make the key a root again. A mandate revocation can be removed once the mandate has expired, since no verifier accepts it then. One whose mandate the appliance cannot retrieve has no known expiry: removing it is your call, and if the mandate is still valid it verifies again. Revoking a root identity also requires removing it from the roots.

          

          
    
            
            
  • Nothing revoked.
    • 
          

          

            
Revocation kind

            
            
          

          
        


        

          

          

        

      

    

  


  

    

      
Public identities

      
No public identities registered yet.

      
    
        
      

      

      

        
Register a public identity

          
Use a key from this browser

          
          

            

            
          

          
        

        
Registration grants no authority until the fingerprint is included in a published policy. Enrolled administrators and current or pending policy roots cannot be removed; removing a registration alone does not revoke a mandate.

      

    

  


  

    

      
Publications

      
If sign-in or publication was interrupted, open it here to load its status and any saved draft. Unsaved edits stay in this browser tab during sign-in; reloading discards them.

      

      
Save your edits before opening another draft or publication.

    


    

      
Publication job

      

        

        

          
Job

          
Draft

          
Published CID

        

        
Retrying. 

        
Raw job

      

    

  




        

  

    
.nomos.web.activity

    

    

  


  

    
    
    
  


  

    

      
Verification result

      

        

          

          
Response detail

        

        
Rechecks the login mandate with its TA verifier. A rejected chain and an unavailable verifier remain distinct; neither grants access.

      

    

  


  

    

      
Publications

      
No publications yet
Policy updates and their delivery status appear here.

      

      

    

  


  

    

      
Audit history

      

        
        Include reads
        

      

      
A record of every action
Who changed what, with which mandate, and the result.

      

      
No loaded events match the filter.

      
Load more to reach the latest events.

    

  




      

      
    

  

  
    
Scan a QR code

    

      
Scan , such as one printed by nomos id export --qr or nomos bundle --qr.

      
      

      
    

  
  
    

    

      

        
        
      

      
This is the private key file, encrypted under its passphrase. Anyone who can see this code can photograph it and try to guess the passphrase: show it only where nobody else can.

      
      
The code holds the text itself. Scan QR in another nomos dashboard, or any QR reader, gives back exactly what saving it would.