Registration Steps

Step 1: Generate key pair

Create a device key pair locally in your browser. The private key never leaves your device.

Cipher Scheme

Must match the target server's scheme (Step 2).

Step 3: Register Agent Key via NHP-REG

Sending verification code...

A 6-digit code has been sent to . It expires in 5 minutes.

Verification Code

No code? Go back and send a new one.

How registration works

API Usage Examples

// npm install @opennhp/agent
import { NHPAgent } from '@opennhp/agent';

// ── Step 1: generate key pair ─────────────────
const agent = new NHPAgent({
  cipherScheme: 'curve25519',  // or 'gmsm'
  transport:    'relay',
  relayUrl:     'https://relay.opennhp.org/relay',
});
await agent.init();

agent.addServer({ publicKey: '<server-public-key-base64>' });
agent.setIdentity({
  userId:   'alice@example.com',
  deviceId: 'my-laptop-01',
});

// ── Step 2: request OTP (NHP-OTP) ─────────────
const otpResult = await agent.requestOtp(
  'example',               // Auth Service Provider ID
  { email: 'alice@example.com' },
);
// Server emails alice@example.com a 6-digit code

// ── Step 3: register key (NHP-REG) ────────────
const regResult = await agent.registerPublicKey(
  'example',               // same ASP ID
  '123456',               // OTP from email
  { email: 'alice@example.com' },
);

if (regResult.success) {
  console.log('Registered! Public key:', agent.getPublicKey());
  // regResult.expiresAt — unix-seconds, or undefined if no TTL
} else {
  console.error(regResult.error, regResult.errorCode);
}

The private key never leaves the device. registerPublicKey() sends the NHP-REG packet inside a Noise handshake that cryptographically proves key possession — no separate signature field needed.

import { NHPAgent, OtpResult, RegisterResult } from '@opennhp/agent';

const agent = new NHPAgent({
  cipherScheme: 'curve25519',
  transport:    'relay',
  relayUrl:     'https://relay.opennhp.org/relay',
});
await agent.init();

agent.addServer({ publicKey: '<server-public-key-base64>' });
agent.setIdentity({ userId: 'alice@example.com', deviceId: 'my-laptop-01' });

// Step 2 — NHP-OTP
const otp: OtpResult = await agent.requestOtp('example');
if (!otp.success) throw new Error(otp.error);

// Step 3 — NHP-REG (otp from email)
const reg: RegisterResult = await agent.registerPublicKey(
  'example', '123456',
);
if (reg.success) {
  const pubKey: string = agent.getPublicKey();
  const expiresAt: number | undefined = reg.expiresAt;
}

Full type definitions are shipped with the package. OtpResult and RegisterResult are both exported from @opennhp/agent.

# Interactive: prompts in order for email, cipher scheme, ASP id,
# resource id, cluster, device and org, then the emailed OTP.
# Reads the target server from etc/server.toml.
nhp-agentd register

# Supply the identity up front to skip those prompts. The cipher
# scheme is always prompted (no flag), and cluster / device / org
# are prompted only when their flags are omitted.
nhp-agentd register \
  --email     alice@example.com \
  --asp-id    example \
  --res-id    demo \
  --device-id my-laptop-01 \
  --org-id    opennhp.org

# --otp skips the NHP-OTP request round-trip when you already have
# a code (the cipher-scheme prompt still appears).
nhp-agentd register \
  --email   alice@example.com \
  --asp-id  example \
  --res-id  demo \
  --otp     123456

# On success the command offers to write etc/config.toml +
# etc/resource.toml; if they exist it prompts before overwriting
# and keeps a .bak, so `nhp-agentd run` can reuse the key.

The register command generates a key pair locally, self-registers its public key over NHP-OTP / NHP-REG, and offers to save the result to config.toml / resource.toml (prompting before overwriting an existing file, keeping a .bak). Flags: --email, --asp-id, --res-id, --server (cluster name from server.toml), --device-id, --org-id, --otp. The cipher scheme is always prompted; other omitted fields are prompted only when their flag is absent.

# NHP-OTP and NHP-REG packets are binary, Noise-encrypted and sent
# over UDP (or bridged through the HTTPS relay). There is no plain
# JSON/HTTP endpoint to curl directly — the relay forwards opaque
# encrypted frames:

curl -X POST https://relay.opennhp.org/relay/<server-fingerprint> \
  -H "Content-Type: application/octet-stream" \
  --data-binary @nhp-packet.bin

# The packet must be built by a binding that speaks the NHP Noise
# handshake — use the JavaScript SDK or the CLI tabs above, or the
# Go endpoints/agent package. On success NHP-REG returns NHP-RAK:
# { "errCode": "0", "aspId": "example", "expiresAt": 1234567890 }

There is no language-agnostic HTTP API for registration — the payload is a Noise-encrypted binary frame. Use the CLI tab (nhp-agentd register), the JavaScript SDK, or the Go endpoints/agent package; for other languages implement the Noise handshake per the NHP-OTP / NHP-REG message spec.

NHP-Agent Key Registration Workflow Demo

Registration Steps

Step 1: Generate key pair

Step 2: Get verification code via NHP-OTP

Step 3: Register Agent Key via NHP-REG

Demo nhp-server configuration