Skip to main content

Examples

Everything here is in the examples/ directory of the code repository and runs locally.

ExampleNeedsShows
Demo A — ConsentDockerUser consent across two independent service providers, and the full audit trail
Demo B — Travel ConciergeDocker + LLM keyA real LLM agent calling a protected MCP tool, plus revocation and delegation
Delegation chainNodeOne agent sub-delegating a reduced credential to another
Local verification scriptsNode + running APIVP verification, scope checks, self-verification, revocation, session bridge
Framework middlewareNode + running APIThe real LangChain and MCP adapters, unmocked

New here? Start with Demo A. It needs no API key and shows the whole identity → consent → verification → action → audit story end to end.

Standalone verifier scripts

Start the API first:

set -a; source .env; set +a
pnpm --filter @helixid/api start

Then run any of:

pnpm example:verify-vp
pnpm example:verify-vp:sdk
pnpm example:verify-vp:session-bridge
pnpm example:scope-check
pnpm example:self-verify
pnpm example:revocation-check

These mint fresh credentials and sign fresh VPs automatically — no fixture file needed. Details in Local Verification.

Verifier fast-path patterns

Both supported patterns have a runnable cycle. See Hybrid 3-Layer Design for when to choose which.

Path A — verifier-issued JWT session

JWT_SECRET=replace-with-a-strong-secret \
pnpm --filter @helixid/api exec tsx ../examples/verifier-session-cycle.ts

Verify a VP once → issue a verifier-owned JWT → subsequent calls verify the JWT locally until TTL expiry.

Path B — VP-result caching (no JWT)

pnpm --filter @helixid/api exec tsx ../examples/verifier-vp-cache-cycle.ts

Verify a VP once → cache the result by vpId with a TTL → subsequent calls with the same vpId are cache hits.

In both paths the verifier owns the policy and infrastructure decisions: scope checks, the replay/cache store, TTLs, headers, and secrets.

Framework middleware

examples/framework-middleware demonstrates the real LangChain and MCP adapters without mocking the Helix client. It uses the live HelixID API, creates a real agent DID during onboarding, stores an encrypted wallet, requests real VP templates, signs VPs locally, and verifies them through the API.

Configure .env for the local API flow first:

HELIX_ADMIN_API_KEY=...

Then:

pnpm install
set -a; source .env; set +a
pnpm --filter @helixid/api dev

In another terminal with the same environment exported:

pnpm example:middleware:setup
pnpm example:middleware:langchain
pnpm example:middleware:mcp

The setup script writes examples/framework-middleware/agent/wallet.enc, which is ignored by that example package. The scripts log DIDs, VC ids, scopes, and verification results, but never print private keys or wallet contents.