Grantor documentation#

OAuth with no authorization server. A caller presents a deed — a self-certifying credential it mints itself — and your app verifies it with a library call against a public on-chain registry. There is no auth server to run, trust, page at 3am, or subpoena. Grantor operates no service in this path; the trust anchor is a contract anyone can read.

A grantor is the party that grants a right. A deed is the artifact that records it. The word is deliberately plain and lowercase, the way passkey is: Grantor is the brand, a deed is the thing.

The 30-second model#

1. Your app issues a challenge (the OIDC nonce shape — one value, one use).
2. The caller signs or proves against it and returns a deed. No redirect, no token endpoint, no round trip to anyone.
3. Your app calls verify_deed, which checks the cryptography and reads the on-chain registry: is this tenant paid up, and for agents, is this member still un-revoked?
4. You mint your own session however you already do. Grantor never sees it.

Step 3 is a plain eth_call — a read. It costs no gas, needs no API key, and works from any RPC provider.

Pick your path#

Three kinds of deed#

user-sig and agent-zk both verify through one call, verify_deed. admin-sig has its own entry point that verify_deed refuses, so an ordinary app cannot accept an admin deed even by mistake.

Every capability, every language#

The product rule is all languages or no go: a capability that ships in one language has not shipped. Enforced by just capability-matrix, which inspects the generated binding surfaces rather than the Rust source.

There is no authorization server in this product — the credential self-certifies and your app verifies it against the public chain.

Reference#

• Concepts: the mental model — read this first.
• Machine docs: llms.txt (index) · llms-full.txt (everything, one file).
• Every page here is also Markdown — same URL, .md instead of .html.
• Live, per RP deployment: an app that accepts deeds publishes its own /.well-known/grantor-deed discovery document and challenge endpoint — see Sovereign tier § Discovery.

Guides#

• Concepts — the mental model
• Getting started
• Verify a deed — the relying-party side
• Wallet login — user-sig, for humans
• Agent tokens — agent-zk, for machines
• MCP server auth — gate a remote MCP server with a deed, no authorization server
• Sovereign tier — the full deed reference
• Errors

Agents (LLM-first)#

• Agent integration
• Agent onboarding

Internal (contributors)#

• Architecture
• Code map
• Security model
• Testing
• Contributing

Status: developer preview. The contract and the full six-language end-to-end proof run on a local devnet (anvil). It has not been deployed to a public testnet or mainnet, and grantor-verify is not yet published to any package registry — today it resolves by path inside this workspace. It has not been audited. Do not put it in front of production money.

Licence: proprietary, all rights reserved. The source is readable — package registries distribute source — but that is not a grant of rights. You may use these libraries to integrate with Grantor; you may not fork, redistribute, or build a competing service with them. Full terms in LICENSE; enquiries for broader terms are welcome.