Crate ockam

source ·
Expand description

End-to-end encrypted, mutually authenticated, secure communication.

A hands-on guide 👉.

Data, within modern distributed applications, are rarely exchanged over a single point-to-point transport connection. Application messages routinely flow over complex, multi-hop, multi-protocol routes — across data centers, through queues and caches, via gateways and brokers — before reaching their end destination.

Transport layer security protocols are unable to protect application messages because their protection is constrained by the length and duration of the underlying transport connection.

Ockam makes it simple for our applications to guarantee end-to-end integrity, authenticity, and confidentiality of data. We no longer have to implicitly depend on the defenses of every machine or application within the same, usually porous, network boundary. Our application’s messages don’t have to be vulnerable at every point, along their journey, where a transport connection terminates.

Instead, our application can have a strikingly smaller vulnerability surface and easily make granular authorization decisions about all incoming information and commands.


  • End-to-end encrypted, mutually authenticated secure channels.
  • Multi-hop, multi-transport, application layer routing.
  • Key establishment, rotation, and revocation - for fleets, at scale.
  • Lightweight, Concurrent, Stateful Workers that enable simple APIs.
  • Attribute-based Access Control - credentials with selective disclosure.
  • Add-ons for a variety of operating environments, transport protocols, and cryptographic hardware.


Tutorials, examples and reference guides are available at



  • Access Control
  • Ockam general bi-directional channel
  • Compatibility adapter, mostly for no_std use.
  • Debugger
  • A module to export the error code in a meaningful way
  • Flow Controls
  • List of all top-level services
  • Ockam pipe module
  • Pipe2 composition system
  • Advanced Ockam worker protocols
  • RemoteRelay allows registering node within a Cloud Node with dynamic or static alias, which allows other nodes forward messages to local workers on this node using that alias.
  • Module containing types for managing Streams.
  • Types and traits relating to ockam vaults.
  • A collection of utility workers for various use cases.




  • An enumeration of different error types emitted by this library.
  • This enum represents the set of types that we currently support in our database Since we support only Sqlite at the moment, those types are close to what is supported by Sqlite:


  • Clone trait for async structs.
  • This trait provides some syntax for transforming sqlx errors into ockam errors
  • A user defined message that can be serialised and deserialized.
  • Defines an interface for Ockam Workers that need to continuously perform background operations.
  • Handle a single type of message for a worker system-address
  • This trait adds a create_tcp_transport method to any struct returning a Context. This is the case for an ockam::Node, so you can write node.create_tcp_transport()
  • This trait can be implemented by any type that can be converted to a database type Typically an Identifier (to a Text), a TimestampInSeconds (to an Integer) etc…
  • This trait provides some syntax to shorten queries execution returning ()
  • Defines the core interface shared by all Ockam Workers.


  • Produces Ok(true) to avoid an ambiguous reading from using the unadorned value in auth code.
  • Produces Ok(false) to avoid an ambiguous reading from using the unadorned value in auth code.
  • A generator for unique, human-readable identifiers suitable for use in distributed systems.

Type Aliases

Attribute Macros

  • Marks an async function to be run in an ockam node.
  • Mark an Ockam Processor implementation.
  • Marks an async test function to be run in an ockam node.
  • Mark an Ockam Worker implementation.

Derive Macros