Managing your DID document.

Manual download & deploy

The simplest approach. Download the ZIP from the dashboard, extract it to your web server root.

1. Log into the TrustDID dashboard
2. Click Download Bundle
3. Extract the ZIP to your domain root (the .well-known/ directory is included)
4. Check it: visit https://yourdomain.ca/.well-known/did.json

Frequency: whenever you rotate keys or add profiles. Typically a few times per year.

Scheduled pull script

A cron job or Windows Task Scheduler that periodically pulls the latest DID from the TrustDID API and deploys it to your web root. Set it and forget it.

# /etc/cron.d/trustdid-did-sync
0 3 * * * root curl -sS -H "Authorization: Bearer YOUR_TOKEN" \
  https://trustdid.ca/api/business/YOUR_ID/.well-known/did.json \
  -o /var/www/html/.well-known/did.json

# sync-did.ps1
$headers = @{ "Authorization" = "Bearer YOUR_TOKEN" }
Invoke-WebRequest `
  -Uri "https://trustdid.ca/api/business/YOUR_ID/.well-known/did.json" `
  -Headers $headers `
  -OutFile "C:\inetpub\wwwroot\.well-known\did.json"

# Pull from API and auto-sign
trustdid-setup --pull

Git-based workflow

Store your did.json in a Git repository. Changes go through pull requests with review and approval. Merging to main triggers deployment via your existing CI/CD pipeline.

1. Pull from API — a script fetches the latest DID from the dashboard into a branch
2. Review the diff — the team sees exactly what changed (new key, rotated key, removed profile)
3. Approve and merge — standard PR workflow with an audit trail
4. CI/CD deploys — the pipeline copies .well-known/did.json to production

# .github/workflows/did-sync.yml
name: Sync DID Document
on:
  schedule:
    - cron: '0 3 * * *'  # daily
  workflow_dispatch:       # manual trigger

jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Pull latest DID
        run: |
          curl -sS -H "Authorization: Bearer ${{ secrets.TRUSTDID_TOKEN }}" \
            https://trustdid.ca/api/business/${{ secrets.TRUSTDID_ID }}/.well-known/did.json \
            -o .well-known/did.json
      - name: Create PR if changed
        uses: peter-evans/create-pull-request@v5
        with:
          title: "Update DID document"
          body: "Auto-synced from TrustDID dashboard"
          branch: did-update

This gives you Git history, diff review, approval gates, and automated deployment — the same workflow your team already uses for code.

Reverse proxy (transparent)

Configure your web server to proxy /.well-known/did.json requests to the TrustDID API. Visitors hit your domain, but the response comes from TrustDID transparently. No manual deployment — changes appear instantly.

location = /.well-known/did.json {
    proxy_pass https://trustdid.ca/api/business/YOUR_ID/.well-known/did.json;
    proxy_set_header Authorization "Bearer YOUR_TOKEN";
    proxy_cache_valid 200 5m;
}

<Location "/.well-known/did.json">
    ProxyPass "https://trustdid.ca/api/business/YOUR_ID/.well-known/did.json"
    RequestHeader set Authorization "Bearer YOUR_TOKEN"
</Location>

CLI push

The moment something changes, push it. One command uploads your did.json — together with its .vrfy signature and the .vrfy.log key-history chain — to the server. No polling, no waiting for a scheduled pull.

# Push your identity files in one step
trustdid-setup --push

# Uploads:
#   did.json           — your DID document
#   did.json.vrfy      — its signature sidecar
#   did.json.vrfy.log  — the key-history audit chain

Run it by hand after a rotation, or wire it into the same script that rotates your keys — the push happens in seconds, fully automated. No cron jobs, no polling, no delay.

Because the .vrfy and .vrfy.log travel with the DID document, verifiers always see a key history that matches the keys you just published.