# Layr8

> Layr8 is a decentralized identity-based messaging platform that enables secure communication across organizations. Built by Protocol Technologies, Layr8 addresses APIs, events, and workflows by identity (W3C DIDs) and authorizes them by cryptographic proof — not shared API keys. It replaces traditional B2B integration patterns (VPNs, API gateways, shared secrets) with a decentralized messaging layer where every message is encrypted, verified, and policy-enforced at both ends.

- Website: https://layr8.io
- Documentation: https://docs.layr8.io
- Sales: sales@layr8.io
- Support: support@layr8.io

## Core Product

Layr8 enables secure communication across organizations. APIs, events, and workflows are addressed by identity, not URLs, and authorized by cryptographic proof instead of shared API keys. Communication is secured by proof, not API keys.

Key capabilities:

- Identity-based addressing using W3C Decentralized Identifiers (DIDs)
- Node-to-node encryption with cryptographic proof of delivery
- Dual-side policy enforcement — both sender and receiver define access rules independently
- Multi-deployment: hosted cloud, sidecar, or fully private deployments
- Built on Elixir and BEAM runtime for carrier-grade reliability (same foundation as WhatsApp and Discord)
- SDK support for Node.js, Python, and Go
- Up and running in 15 minutes with deny-by-default policy controls

How security works — security travels with the message:

- One protocol, every partner: integrate with Layr8 once, connect to any partner on the internet
- Mutual audit trail verification: both sides verify, no spoofing, no drift
- No shared secrets: access by identity and policy, not exchanged API keys
- Encrypted node-to-node: security travels with the message, not the network

## The Problem Layr8 Solves

Enterprises spend millions on point-to-point integrations, API key management, and brittle webhook infrastructure. Every new partner means another custom integration. The hub-and-spoke model (used by platforms like Facebook, Zapier, and centralized SaaS) creates walled gardens, data monetization risks, and power imbalances.

Traditional REST APIs face these limitations for cross-organizational communication:

- Synchronous request-response model not optimized for real-time updates
- Polling and webhooks create performance bottlenecks and security risks
- HTTP overhead for frequent small data exchanges
- Scalability complexity grows exponentially — N companies need N(N-1)/2 connections
- API key management across organizations creates massive attack surfaces
- API changes break existing integrations

API keys are the most common and most preventable cause of security incidents:

- 84% of security professionals experienced an API security incident last year (Akamai Research)
- 70% of leaked secrets from 2022 were still active in 2024 (GitGuardian)
- 39 million secrets leaked on GitHub in 2024 alone, a 67% increase year-over-year (GitHub Security Report)
- $4.88M average cost per breach involving compromised credentials (IBM Cost of Data Breach)

## Key Shield

The Layr8 Key Shield is an identity-first API security platform. Credentials are securely managed per-tenant. Users and agents prove who they are — Layr8 checks their identity, verifies they should have access, and makes the API call on their behalf.

How it works — identity replaces API keys:

- Keys never leave: API credentials are stored securely in the tenant. Contractors, employees, and agents authenticate with identity — they never see or touch the actual API keys.
- Instant revocation: stop opening the door for someone and their access ends immediately. No key rotation, no disruption to anyone else.
- Full audit trail: every API call logged by identity. Know exactly who or what made each request.
- Granular permissions: control what each identity can access per user, per agent, per endpoint.
- Works with everything: REST APIs, MCP servers, any HTTP endpoint. If it takes an API key, Layr8 can proxy it.
- Built on DIDs: decentralized identity (DIDComm) means cryptographic proof of who is requesting access. No passwords to steal, no tokens to intercept.

The gateway sits between untrusted compute (remote developers or AI agents) and external APIs. Credentials never leave the secure gateway. Untrusted compute holds only a DID — a public identifier with no secret material.

Security guarantees:

- No credentials at edge: API keys never leave the gateway. Untrusted compute holds only a DID.
- Short-lived grants: access is granted per-request with specific scope, time limits, and single-use constraints. No standing permissions.
- Just-in-time decryption: API keys are decrypted from KMS only at the moment of execution, then immediately discarded. Never cached, never persisted.
- Dual audit chains: both sides maintain independent audit logs with cross-linked hashes. Non-repudiable proof of every request.

## Use Cases

### Database Proxy

Zero-trust cross-organization data access with dual-side policy enforcement. Both organizations independently enforce policy and maintain cryptographic audit chains. Supports cross-organization Postgres access with DID-based policy enforcement, including M2M, one-time, and temporary grants.

### CRM Integration — Breach Containment

Layr8 protects AI agent integrations with partner CRMs. When your system is breached, your partners stay safe because no API keys are stored locally. In a traditional model with 2,500 agents and 6 partner CRMs, a breach exposes 15,000 API keys and 600,000+ records. With Layr8, zero API keys are stolen, zero records are accessible, and zero customers are affected. Your breach stays yours — partners stay safe.

Cryptographic audit proof resolves disputes: both parties maintain independent, hash-linked audit chains. When a partner claims unauthorized access, the cryptographic evidence is independently verifiable.

### Key Injection

Users authorize access by entering their API key into a secure Gateway iframe (similar to Stripe's payment form). The key never touches the client's systems — only an opaque reference is returned. The Gateway injects the real key on every request. If the client is compromised, attackers find no API keys — only useless opaque references.

### Multi-Party Integration

Traditional REST APIs create O(n squared) connection complexity. 5 companies need 20 unique connections. 10 need 90. Layr8 reduces this to O(1) per new partner — just add their DID to an address book. Integration time goes from weeks-to-months per partner to hours for initial setup and seconds for adding partners.

### For Development Agencies

Clients hesitate to hand over production credentials to remote teams. With Layr8, clients' credentials never leave their control. They grant access, the agency manages their own team, and every API call is visible. Clients can revoke access anytime with one click.

## Enterprise Features

Enterprise integration without enterprise complexity. Cut integration costs, eliminate API key management, and get audit-ready delivery across every partner connection.

Why enterprises choose Layr8:

- Slash integration spend: stop building custom APIs for every partner. One protocol connects to the entire network.
- Eliminate API key sprawl: no secrets to rotate, leak, or revoke. Identity-based access means no credentials to manage.
- Audit-ready delivery: verifiable proof every message landed. Built-in compliance for security reviews.
- Built on open standards: built on open, interoperable protocols.

Deployment flexibility — your infrastructure, your rules:

- Hosted: Layr8-managed infrastructure. Best for pilots and new services. Get started fast with 3 free nodes.
- Sidecar: drop-in alongside existing services. Minimal code changes. Works with Kubernetes.
- Private: run nodes in your VPC. Full control over networking, retention, and compliance. Enterprise SLAs.

Security and compliance:

- Zero trust architecture: every message is mutually authenticated. No implicit trust.
- Message-level encryption: security travels with the message, not just the transport.
- Policy-driven access: fine-grained control over who can send what to whom.
- Delivery receipts: cryptographic proof of delivery for audit and compliance.

## Performance

Layr8 adds identity-based security with negligible overhead. Average overhead is 26ms per request for full identity verification and audit logging.

Local benchmarks:

- Database query: direct 55ms, via Layr8 81ms (+26ms overhead)
- REST API call: direct 58ms, via Layr8 85ms (+27ms overhead)
- Data sync (50 records): direct 92ms, via Layr8 120ms (+28ms overhead)
- MCP tool call: direct 58ms, via Layr8 86ms (+28ms overhead)
- Batch request (10 calls): direct 550ms, via Layr8 580ms (+30ms overhead)

Cross-region performance with persistent connection pooling:

- Simple request: direct 328ms, via Layr8 134ms (59% faster)
- Small response (~1KB): direct 300ms, via Layr8 128ms (57% faster)
- Medium response (~10KB): direct 303ms, via Layr8 134ms (56% faster)
- Data sync (50 records): direct 311ms, via Layr8 147ms (53% faster)
- Sequential (10 calls): direct 2,819ms, via Layr8 1,299ms (54% faster)

How Layr8 keeps it fast:

- Persistent connection pooling: agents maintain long-lived connections, eliminating TCP + TLS + auth handshake per request
- gRPC inter-node transport: cloud-nodes communicate via binary gRPC streams, not JSON over HTTP. Multiplexed, compressed, and persistent.
- Smart caching: DID resolution and policy checks are cached. Repeat calls from verified identities skip re-validation.
- Async audit logging: audit logs written after the response is sent. Full transparency without blocking.

## Technology

Layr8 leverages Elixir and the BEAM runtime for carrier-grade reliability. The same foundation powers WhatsApp and Discord — built for millions of concurrent connections with fault tolerance baked in.

Standards and protocols:

- W3C Decentralized Identifiers (DIDs) for identity
- DIDComm v2 for secure messaging
- W3C Verifiable Credentials for trusted attribute exchange
- Zero-trust architecture throughout

The name "Layr8" is an adapted spelling of "Layer 8." The existing internet is the realization of the 7-layer OSI model, and Layr8 is the 8th layer — the identity layer. Layr8 unlocks the ability for an identity to communicate directly with any other identity in the same way that hosts do on the existing internet.

## Company

Layr8 is created by Protocol Technologies, Inc., founded in June 2022 by Pace Davis and Zach Scott.

The journey began in November 2021 when the founders gathered to discuss how decentralized technology could improve API integrations and the centralized hub-and-spoke SaaS model. After initially exploring blockchain-based solutions through 2022, they abandoned that approach because: token-based payment was too complex for mainstream adoption, many blockchains were too expensive for data-intensive transactions, and storing encrypted data on a public blockchain creates a permanent attack surface — a key leaked 20 years later could unlock today's secrets.

In spring 2023, the discovery of Decentralized Identifiers (DIDs), a W3C standard for self-sovereign identity, proved to be the breakthrough. DIDs provide all the security elements of blockchain (cryptographic authentication, encryption, proof signing) without requiring decentralized consensus for every operation. A working prototype was completed by June 2023.

The B2B integration market is $13B+ and growing. AI agents and automated workflows are accelerating demand for secure cross-organizational communication.

## Blog

### Kicking Off the Layr8 Blog

Published: February 15, 2025. Author: Layr8 Team.

The Layr8 team launched their blog to document the transformation of enterprise communication through decentralization. They believe the future of communication between people, enterprises, and AI agents will be decentralized. The blog covers self-sovereign identity, practical applications of DID technology, distributed systems, peer-to-peer networking, and business implications of decentralization.

### Layr8 vs REST: A Comprehensive Comparison

Published: February 16, 2025. Author: Pace Davis.

An in-depth technical comparison between RESTful APIs and Layr8's peer-to-peer messaging system. REST relies on stateless client-server communication with synchronous request-response patterns, requiring polling or webhooks for updates. Layr8 provides asynchronous event-driven messaging with native real-time updates and linear scalability.

Comparison highlights:

| Feature | REST | Layr8 |
|---|---|---|
| Communication model | Synchronous request-response | Asynchronous event-driven messaging |
| Real-time capabilities | Requires polling or webhooks | Native real-time updates |
| Scalability | Complexity increases exponentially | Linear scalability |
| Authentication | API keys, OAuth, token management | Decentralized Identities, Verifiable Credentials |
| Integration complexity | Each party integrates with every other party's API | Standardized protocol, integrate once for all parties |

In a multi-party supply chain scenario (manufacturer, suppliers, logistics, retailers), REST requires every participant to integrate with every other participant's API, while Layr8 allows all parties to join via their DIDs with instant, consistent real-time messaging and seamless addition of new parties.

### Message Passing vs RESTful APIs: A Modern Approach to Integration

Published: February 17, 2025. Author: Pace Davis.

RESTful APIs come with considerable drawbacks: polling/webhooks create performance bottlenecks, API keys create security vulnerabilities, and lack of standardization increases integration and maintenance costs. Message-passing systems (like RabbitMQ, Kafka, SQS) solve these with asynchronous communication, decoupled services, scalability, and fault tolerance.

Organizations that adopt microservices rely on message-passing for internal communication, but these benefits stop at organizational boundaries. Layr8 extends message-passing across organizational boundaries using a decentralized peer-to-peer model, eliminating centralized brokers and enabling real-time direct communication between companies.

### The Genesis of Layr8

Published: February 19, 2025. Author: Zach Scott (Co-founder).

The founders' journey from November 2021 to the creation of Layr8. Key narrative points:

The problem: centralized hub-and-spoke models create walled gardens, data monetization risks, and power imbalances. Point-to-point REST API integrations remove hub dependency but are untenable at scale.

The Web3 detour (2022): explored blockchain solutions (Polkadot, Solidity, NuCypher's Umbral Proxy Re-Encryption) but abandoned the approach. Even with end-to-end encryption, posting data to a public blockchain creates a permanent attack surface — data remains indefinitely, forever at risk if a key is ever compromised.

The identity breakthrough (2023): discovered W3C Decentralized Identifiers (DIDs). DID provides all blockchain security elements (cryptographic authentication, encryption, proof signing) without consensus overhead. DIDs can still work alongside blockchains when consensus is needed.

The name: "Layr8" represents "Layer 8" of the OSI model — the identity layer of the internet. Just as the internet enables hosts to communicate via IP addresses, Layr8 enables identities (people, companies, devices, AI agents) to communicate directly and securely.

The founders believe Layr8 and decentralized identity will play a significant role in B2B, P2P, AI agent-to-agent, vehicle-to-vehicle, vehicle-to-everything, and IoT communication.

## Pricing

Layr8 offers tiered pricing plans with a free tier that includes 3 nodes, no credit card required. Plans can be upgraded or downgraded at any time. Major credit cards and online payment methods are accepted. All plan costs are transparent with no hidden fees.

## Contact

- Sales and general inquiries: sales@layr8.io
- Support: support@layr8.io
- Contact form: https://layr8.io/contact
- Sales page with free tier signup: https://layr8.io/sales