Skip to content
NOQTIS

noqtis-idcard(1)

noqtis-idcard — make or check an identity card for a signing key

noqtis idcard -k key [-p key.pub] --name name [--orcid id] [--email address] [--url url] [--affil text] [-o file] [-f]

noqtis idcard --verify card [-p key.pub]

noqtis idcard writes an identity card (‘noqtis-idcard-1, noqtis-capsule(5)’): the public key of key with your name and, when given, your ORCID iD, e-mail address, web page and affiliation, signed by key itself. Publish the card beside your capsules (on your web page, in a repository, with a paper) and give the SHA-256 of the key somewhere people already know you by. noqtis-check(1) --card then says who sealed a capsule.

A card is self-signed: its signature shows that whoever holds the key wrote it and that nothing in it changed since, not that the name is true. What ties the name to the key is the key's SHA-256 that you published, or a public key the checker already trusts (-p). Its signature is made under its own context, ‘noqtis-idcard-1’, so a card is never taken for a seal or a key statement, nor they for a card. The signature is checked before the card is written, and the secret key is never in it.

The creation time is SOURCE_DATE_EPOCH when set, as for noqtis-seal(1), else the clock.

With --verify, noqtis-idcard checks card and prints the fields it holds, its key's algorithm and the SHA-256 of its public key (as noqtis-inspect(1) prints a seal's). With -p, the card must also be for that key.

key, --key=key
The secret signing key the card is for: ML-DSA, SLH-DSA or a hybrid, not Ed25519 alone.
key.pub, --pub=key.pub
Its public key (default key.pub); with --verify, the key the card must be for.
name
Your name as you want it shown: 1 to 255 bytes of UTF-8, no control character, no space at either end.
id
Your ORCID iD, as ‘0000-0002-1825-0097’ or its ‘https://orcid.org/’ address; its last character must be its ISO 7064 MOD 11-2 check digit (X for 10). The card holds the bare iD.
address
An e-mail address ‘local@domain.tld’, at most 254 bytes, no space.
url
A web page: an ‘https://’ address with a host, at most 1024 bytes, no space.
text
Your affiliation, as --name.
file, --out=file
Write the card to file (mode 0644) instead of standard output.
, --force
Replace file if it exists.
card
Check a card instead of making one.

0
The card was written, or it verifies.
1
The card does not verify, is not a card, or is for another key than -p.
2
A usage error, a field out of its limits, a key file that cannot be read, keys that are not a pair or not post-quantum, or a file that cannot be read or written.

$ noqtis idcard -k me --name "Ada Lovelace" \
    --orcid 0000-0002-1825-0097 --url https://example.org/ada -o me.card
$ noqtis idcard --verify me.card
name     Ada Lovelace
orcid    0000-0002-1825-0097
url      https://example.org/ada
created  2026-10-30T12:00:00Z
alg      ML-DSA-65
key      4587412415426cb336627c940b6a8c921c903d6149cc3e632a891d6de86fe710
me.card: OK (self-signed: compare the key with the one its holder gave)
$ noqtis check -p me.pub --card me.card results

An iD with a wrong check digit is refused:

$ noqtis idcard -k me --name Ada --orcid 0000-0002-1825-0098
noqtis idcard: --orcid 0000-0002-1825-0098: give an ORCID iD such as
0000-0002-1825-0097 (or its https://orcid.org/ address) whose last
character is its check digit

noqtis(1), noqtis-check(1), noqtis-keygen(1), nqcard(3), noqtis-capsule(5)