Agreely Docs
FR EN

Domain and branding

This page covers your company's domain identity and the branding the citizen sees.

Domain verification and did:web identity

The company verifies a domain it controls, under Settings > Domain & verification. The path has three steps:

  1. Save the domain. This creates the company's operational signing key, hosted by Agreely.
  2. Authorize that key with the company's root passkey (Settings > Root passkey), a passkey the company keeps on its own devices. A backup root passkey and a recovery key can be added.
  3. Publish a DNS TXT record at _agreely.<your-domain>. It declares the company's identity, the fingerprint of its signing key and its root key. After a signing-key rotation, the record must be republished.

Verification mints its did:web identity of the form:

did:web:app.agreely.ca:c:{slug}

Agreely hosts the DID document for it and links it to your verified real domain via an alsoKnownAs link. The DID document publishes the company's public key or keys, which lets anyone verify your signatures without going through Agreely.

Defence in depth, not non-repudiation

The operational signing key is generated and hosted by Agreely. Verifying a signature establishes that it comes from the key declared for your domain and that the content has not changed; it does not establish that a person at your company signed it themselves. The root-passkey authorization and the DNS record add layers of defence, without making it proof of non-repudiation.

Verified domain and active signing key required

Issuing signed consent requests requires both a verified domain and an active signing key. Without both, the company cannot produce the signatures a consent request carries.

For the cryptography underneath, see signatures and passkeys and the shape of DID documents.

Custom domain, Growth and up

From the Growth tier onward, the company can configure a custom domain: (Settings > Custom domain): link its host and email domain, and publish the required SPF and DKIM records for email authentication. See the billing tiers for which tiers include the custom domain.

The company uploads a logo under Settings > Organization profile. On receipt, the logo is validated, re-encoded to a small square WebP, and its EXIF metadata is stripped. SVG files are refused for safety, since they can carry script.

The citizen sees this logo on the company cards of their dashboard and in the company-detail header. When there is no logo, a fallback shows the company's initials or emblem.

Fetched by an opaque handle

The citizen fetches the logo by an opaque handle, never by a raw company id. Nothing in how the logo is served lets anyone correlate a company across the citizen surfaces, which preserves unlinkability.

Next