Look up an agent the way a browser looks up a site
did:opena2a is the naming face: it turns an opaque agent into a resolvable name, so AIP, ATX, ATP and AAP all have a key to verify against. It comes first because nothing downstream works without it.
Before the spec: the usual way
The usual way: an agent is just an opaque API key or a bare URL. There is no way to independently look up its public key, so you trust whoever handed you the string.
the usual way
The agent is just an opaque key or URL. There is no way to independently look up its public key or trust endpoints. You trust whoever handed you the string.
did:opena2a is provisional (v0.1 draft, pending W3C DID Method Registry review). The trust model is explicit and not glossed: you trust a did:opena2a name exactly as much as you trust the Registry resolver you configured. Resolution is a cacheable HTTP call (the reference resolver sends Cache-Control max-age=300), so this is not a no-network claim; it is a name-to-signed-key claim. The Ed25519 check is real.
// Resolution is a plain HTTP GET to a configured Registry resolver.
// The reference resolver sends Cache-Control: max-age=300 (cached 5 min).
// Any did:opena2a name resolves the same way; the Registry's own DID always
// resolves and carries the signing key the rest of the stack verifies against.
// (An agent name like did:opena2a:agent:acme-corp/billing-agent resolves
// identically once that agent is registered.)
const did = "did:opena2a:registry:opena2a.org";
const res = await fetch(`https://api.oa2a.org/api/v1/did/${did}`);
if (!res.ok) throw new Error(`resolution failed: ${res.status}`);
const doc = await res.json(); // a W3C DID Document
// The Registry's Ed25519 key is a publicKeyMultibase string (base58btc, z6Mk...).
// Decode it to raw bytes, then AIP and ATX verify signatures against it.
const key = doc.verificationMethod[0].publicKeyMultibase;