Why does the public record hold so little?

By design: the maintainer's README lists only the W3C DID and created/updated timestamps as stored here, with the display name, email hash and profile picture moved to the companion private DNA so the public record stays free of identifying information.

Can a profile be deleted once it is published?

The README says a published identity cannot be deleted by site owners, government actors, or Flowsta itself, which is the point of storing it on a Holochain DHT rather than a server.

How does an app prove a user's identity without a central check?

The application asks the user's Flowsta Vault for a link and commits the resulting attestation to its own DHT; the documentation states anyone on that DHT can verify it with Ed25519 cryptography, needing no shared DNA or API call.

Project · identity

Flowsta Identity DNA

a building block for identity profilesHolochain DNA for decentralized identity profiles and DID resolution

Explore this project Website All projects

How you run it: not recorded
Holochain version: 0.5.6
Activity: active
Checked: 29 October 2026

What is Flowsta Identity DNA and what is it for?

Flowsta Identity DNA is the Holochain DNA behind Flowsta's identity layer: it holds each user's W3C decentralized identifier and the attestations that show two agent keys belong to the same person. It exists so an identity can be registered once on a public network without exposing who the person behind it is, and checked by any application that joins that network.

The Flowsta Identity DNA is documented as the public half of a two-DNA design: this DNA is the record anyone can read, while a companion private DNA keeps everything encrypted on the user's own device. Its early versions stored more than they do now. The maintainer's own history records an email hash and a display name being taken off the public network as personally identifying, and later the profile picture and the flag marking that a picture was set.

What remains on the public network is deliberately thin. A profile carries a W3C decentralized identifier and the timestamps for when it was created and updated, and nothing else. Because agent keys are random cryptographic identifiers, a profile can be looked up and checked without disclosing who wrote it. The same design lets a person prove that two different app identities are theirs, through attestations any participant on the network can verify.

For a Holochain developer the practical example is identity linking. An application asks the user's Flowsta Vault for a link; the Vault signs the request once the user approves it; the application then commits that attestation to its own DHT with a zome call, so other participants can check the link without calling Flowsta. The integration steps are at docs.flowsta.com/holochain/agent-linking, and the DNA source is in the project repository.

How to get it

As a library

Install the SDK: npm install @flowsta/holochain.
Register the application at dev.flowsta.com to obtain a client_id.
Add the flowsta-agent-linking integrity and coordinator zomes to the DNA and reference them in dna.yaml.
Call linkFlowstaIdentity with the app's own agent public key, then commit the returned attestation to your own DHT through the agent_linking zome's create_external_link function.

Source: https://docs.flowsta.com/holochain/agent-linking

In a browser

Install the web SDK: npm install @flowsta/auth.
Construct FlowstaAuth with a client_id and redirect URI, then call auth.login(), which sends the user to login.flowsta.com to approve in their Vault.
Read the returned user object after handleCallback().

Source: https://docs.flowsta.com/

Questions people ask

Why does the public record hold so little?: By design: the maintainer's README lists only the W3C DID and created/updated timestamps as stored here, with the display name, email hash and profile picture moved to the companion private DNA so the public record stays free of identifying information. source
Can a profile be deleted once it is published?: The README says a published identity cannot be deleted by site owners, government actors, or Flowsta itself, which is the point of storing it on a Holochain DHT rather than a server. source
How does an app prove a user's identity without a central check?: The application asks the user's Flowsta Vault for a link and commits the resulting attestation to its own DHT; the documentation states anyone on that DHT can verify it with Ed25519 cryptography, needing no shared DNA or API call. source

From 5 public sources, checked 23 September 2026.

Try Flowsta Identity DNA

Code on GitHubOpen on GitHub ↗Last change 25 October 2026.
Websitedocs.flowsta.com ↗
ReleaseNo GitHub release recorded.
The project's own files do not say how it is run.

Details & sources

Source: WeAreFlowsta/flowsta-identity-dna

Evidence

Last change: api.github.com/repos/WeAreFlowsta/flowsta-identity-dnalisted by a third party · seen since 20 October 2026 · github.repository@1
Activity: api.github.com/repos/WeAreFlowsta/flowsta-identity-dnalisted by a third party · seen since 26 October 2026 · liveness@1

Compatibility

hdk: 0.5.6 · Cargo.toml @ 938d4bf
hdi: 0.6.6 · Cargo.toml @ 938d4bf
holochain-client: —
happ.yaml: present · happ.yaml @ 938d4bf
web-happ.yaml: absent

Do you maintain Flowsta Identity DNA?Add your name to this project’s page.

Claim this page