Last1 ID¶

Identity authority for the Last1 ecosystem. Manages portable credentials, linked auth providers, app links, consent, and trust events.

Architecture¶

Full reference: See ARCHITECTURE_BIBLE.md for schema, endpoints, DID/VC design, and implementation status. See ARCHITECTURE.md for domain and product model.

Identity authority: Last1 ID owns the canonical identity; external providers (Google, Microsoft, ID.me, email) are linked sign-in methods.
Portable credentials: User-owned credentials issued by apps, organizations, facilitators, or the system. Credentials are W3C-compatible verifiable credentials with Ed25519 signatures.
DID-based: Identities and issuers use did:web:last1.id identifiers. DID documents are published for issuer verification methods.
Hard boundary: Last1 ID stores identity, credentials, consent, app links, trust events, and reputation summaries—not full app-domain records.

Setup¶

Install dependencies
```
npm install
```
Supabase (required for auth)
Create a Supabase project
Run migrations from supabase/migrations/
Add SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, VITE_SUPABASE_URL, and VITE_SUPABASE_ANON_KEY to .env
Credential signing (required for issuance)
Add CREDENTIAL_SIGNING_KEY (32+ character secret) to .env
Generate with: openssl rand -base64 32
Credential verification (optional)
Turnstile (human_verified) and Twilio Verify (phone_verified): see docs/CREDENTIAL_VERIFICATION_SETUP.md
Run dev server
```
npm run dev
```
Opens at http://localhost:5003 (or PORT from .env)
Build
```
npm run build
npm start
```

Documentation¶

Doc	Purpose
ARCHITECTURE_BIBLE.md	Schema, endpoints, DID/VC design, env vars, roadmap
ARCHITECTURE.md	Domain, product model, integration assumptions
docs/CREDENTIAL_VERIFICATION_SETUP.md	Turnstile + Twilio setup
docs/TRUST_EVENT_INGESTION.md	Trust event API
docs/E2E_TESTING.md	E2E test setup
docs/INTEGRATION_PIPELINE_WEEK1.md	Cross-org SDK pipeline plan
docs/SDK_COMPATIBILITY_POLICY.md	SDK versioning and upgrade policy
docs/PARTNER_ENVIRONMENTS.md	Dev/stage/prod partner environment model
docs/OBSERVABILITY_BY_ORG.md	Org-scoped auth observability model
docs/SECURITY_COMPLIANCE_PACK.md	Security and enterprise compliance baseline

Migrations¶

Apply migrations to your Supabase project:

supabase db push
# or apply each file in supabase/migrations/ via Supabase dashboard

Implementation status¶

Area	Status	Notes
Pages working	Landing, How it works, Ecosystem, Why, Privacy, Security, Transparency, Developers, FAQ, Login, Signup, Onboarding, Dashboard, Profile, Linked Providers, Credentials, Connected Apps, Consent, Trust Ledger, Export, Settings, App clients
Fully real	Auth (Supabase), identity records, linked providers, app links, consent grants, credentials, trust events, reputation snapshots
DID + VC	did:web for identities/issuers/apps, W3C VC 2.0 envelopes, Ed25519 signing, issuer DID documents, credential status, stateless verification
Scaffolded	Credential verification (Turnstile/Twilio wired but optional), trust event ingestion API (Bearer auth), app client registration UI
Env/config	`SUPABASE_`, `VITE_SUPABASE_`, `CREDENTIAL_SIGNING_KEY` required; `TURNSTILE_`, `TWILIO_` optional; `RADIOCHECK_APP_SECRET`, etc. for trust ingestion
Next step	See ARCHITECTURE_BIBLE.md §11 for roadmap (OpenID4VCI, OpenID4VP, Bitstring Status List)

Canonical app slugs¶

last1
radiocheck
matr-ios
matr-b2b (MATR Biz)
realoutcomes

Scopes use colon-separated format: resource:action (e.g. identity:read, credentials:read, trust_events:write). See shared/constants.ts for CONSENT_SCOPES and SCOPE_DESCRIPTIONS.

TODO: Future scope normalization may migrate to dot-format (identity.read) for OAuth2/OIDC alignment. Colon format is canonical for MVP.

SDK quickstart¶

# Internal helper: create starter env/snippet files in your app repo
npm run sdk:init -- ../your-app

# Pack local SDK artifacts for validation
npm run sdk:pack

For org admins integrating external apps, use the in-portal docs and setup flow: - Company Admin login -> App clients -> Integrations - Set LAST1_ISSUER_URL=https://auth.last1.id - Validate discovery/JWKS before go-live

Credential types¶

Foundational: email_verified, phone_verified, identity_profile_completed, human_verified, veteran_verified

MATR: matr_cohort_member, matr_trust_program_completed, matr_facilitator_confirmed

Other: radiocheck_participant, beneficiary_enrolled, provider_verified

See ARCHITECTURE_BIBLE.md §3 for full mapping to W3C VC types.