Devices

Link, extend, and revoke device attestations.

Device dataclass

Device(did: str, attestation_id: str)

A linked device.

did instance-attribute

did: str

The device's DID (did:key:z...).

attestation_id instance-attribute

attestation_id: str

RID of the attestation linking this device to its identity.

DeviceExtension dataclass

DeviceExtension(device_did: str, new_expires_at: str, previous_expires_at: str | None)

Result of extending a device's authorization period.

device_did instance-attribute

device_did: str

The device's DID (did:key:z...).

new_expires_at instance-attribute

new_expires_at: str

ISO 8601 timestamp of the new expiry.

previous_expires_at instance-attribute

previous_expires_at: str | None

ISO 8601 timestamp of the previous expiry, or None if none was set.

DeviceService

DeviceService(client: Auths)

Resource service for device operations.

Examples:

device = auths.devices.link(identity_did="did:keri:...", capabilities=["sign"])
auths.devices.revoke(device.did, identity_did="did:keri:...")

link

link(identity_did: str, capabilities: list[str] | None = None, expires_in: int | None = None, passphrase: str | None = None) -> Device

Link a new device to an identity.

Parameters:

• identity_did (str) –

  The identity to link this device to.

• capabilities (list[str] | None, default: None ) –

  Device capabilities (default: []).

• expires_in (int | None, default: None ) –

  Duration in seconds until expiration (per RFC 6749).

• passphrase (str | None, default: None ) –

  Key passphrase override.

Returns:

• Device –

  Device with the device DID and attestation ID.

Raises:

• IdentityError –

  If the identity doesn't exist.

• StorageError –

  If writing the attestation fails.

Examples:

device = auths.devices.link(identity.did, capabilities=["sign"], expires_in=7_776_000)

extend

extend(device_did: str, identity_did: str, *, days: int = 90, passphrase: str | None = None) -> DeviceExtension

Extend a device's authorization period.

Renews the device's expiry without revoking and re-linking. Expired devices can be extended (grace period). Revoked devices cannot.

Parameters:

• device_did (str) –

  The device's DID (did:key:z...).

• identity_did (str) –

  The identity key alias for signing.

• days (int, default: 90 ) –

  Number of days to extend from now (default: 90).

• passphrase (str | None, default: None ) –

  Optional passphrase for keychain access.

Returns:

• DeviceExtension –

  DeviceExtension with the new and previous expiry timestamps.

Raises:

• IdentityError –

  If the device or identity doesn't exist.

• VerificationError –

  If the device has been revoked.

Examples:

ext = auths.devices.extend(device.did, identity.did, days=90)
print(f"Extended until: {ext.new_expires_at}")

revoke

revoke(device_did: str, identity_did: str, note: str | None = None, passphrase: str | None = None) -> None

Revoke a device.

Parameters:

• device_did (str) –

  The device DID to revoke.

• identity_did (str) –

  The parent identity's DID.

• note (str | None, default: None ) –

  Optional revocation note.

• passphrase (str | None, default: None ) –

  Key passphrase override.

Raises:

• IdentityError –

  If the device or identity doesn't exist.

Examples:

auths.devices.revoke(device.did, identity_did=identity.did, note="lost laptop")