Quickstart · ECZ-ID SDK Passport™

SDK quickstart

Give a library you publish one free ECZ-ID SDK Passport across every language and registry, declare it in the package manifest, and let consumers check it in CI.

Live · public

The free SDK Passport journey, the public record and the relying-party check are live. Commands were measured read-only on 2026-10-10. Availability is read live in TrustOps.

This quickstart gets the machine its identity. To carry it through the whole Accountability Chain (authority, Intent, decision, Receipt and re-verify), follow the SDK guided flow.

01Know what one Passport covers

You publish a library or SDK. One Passport is one logical library/SDK published by the Parent, across languages and registries.

Law: one SDK -> one Passport; npm/PyPI/Maven/NuGet/Go/OCI channels are bindings; versions/releases are history; a different library is a second Passport.

Never a new Passport: version, release, registry_channel, package_artefact.

02Get the free Passport

Open the SDK door in TrustOps and sign in once. If your organisation has no Business Passport, a free DECLARED one is created. No payment is taken. Have one of these identifiers ready:

repository: host/owner/repo of the source repository
package: ecosystem:name of the published package (no version)
sdk_name: publisher-scoped logical name when neither repository nor package is public

Start the SDK Passport in TrustOps (opens in a new tab)

03Declare it where your ecosystem looks

The families contract names the place: package.json ecz_id/resolver_backlink; pyproject.toml [tool.ecz_id]; README badge. A declaration is a pointer, not proof.

tomlIllustrative package declarations. Use the values your TrustOps console shows.

# package.json
#   "ecz_id": "ECZ-GB-EXAMPL::SDK_PASSPORT-AB12CD",
#   "resolver_backlink": "https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::SDK_PASSPORT-AB12CD"

# pyproject.toml
[tool.ecz_id]
ecz_id = "ECZ-GB-EXAMPL::SDK_PASSPORT-AB12CD"
resolver_backlink = "https://resolver.ecocitizenz.org/p/ECZ-GB-EXAMPL::SDK_PASSPORT-AB12CD"

04Prove a binding

A binding attaches the Passport to a native identity you control. The binding classes this family defines are: PACKAGE_REGISTRY, REPO, GITHUB_OIDC, GITLAB_OIDC, OCI_IMAGE.

Proof is established through TrustOps and ECZ-ID Core, never on this site. Until a binding is proven, the public record reads binding.state: NO_PUBLIC_PROOF, which is the normal state of a new record. A class being defined is not a claim of a live integration with that provider.

05Let relying parties check it

Anyone can check before relying, with no account. This exact command was run on 2026-10-10:

bashMeasured 2026-10-10: NO_PUBLIC_RESOLVER_PROOF_FOUND, exit 0

npx -y @ecocitizenz/ecz-id-mcp-verifier check --target @ecocitizenz/ecz-id-mcp-verifier --target-type npm_package

The verifier package holds no SDK Passport yet; the same is true of ecz-id on PyPI (--target-type pypi_package, measured the same day). npm, PyPI and other channels of one library are bindings of one Passport.

06Next: Intent, decision, Receipt

Live · signed inModel what this machine is authorised to do as an ECZ-ID Intent. Carry Intent
Release-gatedAsk IntentControl for a decision before consequential actions. Request a decision
No public retrievalPlan for Receipts in your records. Verify a Receipt

Go deeper

A free Passport gives a machine a persistent identity. It never means verified, assured, safe, secure, compliant, approved, certified or endorsed. Family facts come from the TrustOps families contract; current state is only ever the live Resolver record.