WAIS Platform

Reference implementation of a WAIS Provider — the token issuer and user data vault for the Web Agent Interaction Standard.

Live at pod.deeger.io

What it does

A WAIS Provider is the trust anchor in the WAIS ecosystem. It:

1. Authenticates humans via Google OAuth
2. Stores personal data in an encrypted vault (SD-JWT credentials)
3. Issues PoD tokens that agents present to sites to prove they act on behalf of a real user
4. Publishes JWKS so sites can verify token signatures
5. Manages API keys for programmatic access (used by MCP servers)

Human ──login──▶ WAIS Provider ──token──▶ Agent ──token+DPoP──▶ Site
                    │                                              │
                    └──── JWKS ────────────────────────────────────┘
                         (site verifies token signature)

API Endpoints

Public

Endpoint	Method	Description
/healthz	GET	Health check + wais-pod version
/.well-known/jwks.json	GET	Platform public keys (ES256)

Authentication

Endpoint	Method	Description
/auth/login	GET	Google OAuth redirect
/auth/callback	GET	OAuth callback
/auth/logout	GET	Clear session

Tokens

Endpoint	Method	Description
/api/tokens	POST	Create PoD token (accepts dpop_jwk for DPoP binding)
/api/tokens	GET	List active tokens
/api/tokens/{jti}	DELETE	Revoke a token

Data Vault

Endpoint	Method	Description
/api/vault/data	POST	Store personal data + generate SD-JWT credential
/api/vault/data	GET	List available claim names (not values)
/api/vault/present	POST	Create selective disclosure presentation
/api/vault/data	DELETE	Delete all vault data

API Keys

Endpoint	Method	Description
/api/keys	POST	Create API key
/api/keys	GET	List API keys (masked)
/api/keys/{key_hash}	DELETE	Revoke API key

Quick Start (Development)

# Clone
git clone git@github.com:deegerhq/wais-platform.git
cd wais-platform

# Setup
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

# Run (dev mode — no SECRET_KEY needed)
uvicorn wais_platform.app:app --reload --port 8000

Open http://localhost:8000 — you'll see the login page.

Configuration

All config via environment variables:

Variable	Required	Default	Description
SECRET_KEY	Yes (prod)	insecure default (dev)	Session encryption key. Crashes if missing in production.
PLATFORM_URL	No	http://localhost:8000	Public URL of this platform
GOOGLE_CLIENT_ID	No	—	Google OAuth client ID
GOOGLE_CLIENT_SECRET	No	—	Google OAuth client secret
DATA_DIR	No	./data	Directory for SQLite database and keys

Generate a secret key:

python -c "import secrets; print(secrets.token_urlsafe(32))"

Production Deployment

See deploy/ for systemd unit, nginx config, and setup script.

# Deploy to server (example)
rsync -avz --exclude .venv --exclude __pycache__ --exclude .git \
  --exclude 'wais_platform/data' \
  ./ root@your-server:/opt/wais-platform/

# IMPORTANT: exclude wais_platform/data to avoid overwriting production DB

Production stack

• Server: Ubuntu 24.04
• Proxy: nginx + certbot SSL
• Process: systemd (wais-platform.service)
• Database: SQLite (WAL mode) at platform/data/platform.db
• Keys: ES256 keypair auto-generated at data/ on first run

Storage

SQLite with 5 tables:

Table	Purpose
users	Google OAuth user profiles
tokens	Issued PoD tokens (jti, audience, scopes, expiry)
api_keys	Hashed API keys for programmatic access
vault_data	Encrypted personal data (name, email, phone, etc.)
vault_credentials	SD-JWT credentials + disclosure maps

Dependencies

• wais-pod — core WAIS library (token, issuer, DPoP, SD-JWT)
• FastAPI + Uvicorn — web framework
• Authlib — Google OAuth
• Jinja2 — HTML templates

Architecture

wais_platform/
├── app.py          # FastAPI app, all routes
├── auth.py         # Google OAuth setup, session helpers, CSRF
├── keys.py         # ES256 key generation, JWKS document
├── models.py       # SQLite persistence (5 tables)
├── templates/      # Jinja2 HTML (login, dashboard, vault, token creation)
└── static/         # CSS

License

MIT — Deeger