Solidus Identity
How this works, explained once
Decentralized identifiers, verifiable credentials and selective disclosure, explained from first principles — how Solidus Identity issues, presents and revokes them.
56 articles
- A Different Identity for Every Relying PartyThe unlinkability implementation described here is unaudited.
- One Credential, Every Relying PartyThe unlinkability implementation described here is unaudited.
- What Is a Decentralized Identifier (DID)?The unlinkability implementation described here is unaudited.
- Proving a Claim Without Handing Over the Whole DocumentThe unlinkability implementation described here is unaudited.
- What Is a Verifiable Credential? (And Why You Keep It, Not the Issuer)A verifiable credential (VC) is a signed, structured claim, not a document scan, not a photo of an ID, a data structure someone with authority signed.
- Resolve a did:solidus DID in Under 10 Lines"Resolving a DID" means one thing: hand a did:solidus identifier to the network and get back its DID Document, the public keys and capabilities behind it.
- What Happens When You Lose Your Device?Losing the device that holds your keys does not mean losing your identity forever.
- What's Inside a DID DocumentEverything below is real. This is a live did:solidus document, fetched directly from the public resolver at rpc.solidus.network, not built from the DID Core spec, not reconstructed from memory of…
- Is Solidus Identity Self-Sovereign Identity?An approach where the person the identity belongs to holds it directly, in a wallet or app they own, instead of a company holding a record about them and deciding when it may be shared.
- Why Your Credential Shows Active, Suspended, or RevokedExpiry is a separate thing and it is baked into the credential itself: a credential can be past its expiry date and still show as active, because "active" describes what the issuer has done, not what the calendar says.
- What Fields Are Actually Inside Your CredentialSolidus does not implement credentialSchema. Our published credential type has no such field, and nothing in our issuance path validates a credential's shape against a published, independently fetchable schema document.
- How Solidus Proves the Credential in Your Wallet Is Actually YoursThe unlinkability implementation described here is unaudited.
- What Happens When You Tap Share: the Key-Binding JWTThe unlinkability implementation described here is unaudited.
- The Digest Your Wallet Sends When You Share Less Than EverythingThe unlinkability implementation described here is unaudited.
- Why Each Disclosed Field Carries Its Own SaltAnd read the scope section before the mechanism section: the honest claim is narrower than the page title suggests.
- The Cryptosuite Field in Your Credential's Proof BlockThere is no cryptosuite field in the credentials we actually issue, and the proof block this page describes does not appear on our wire format at all.
- What `proofPurpose` Means in a Verifiable CredentialOur published type hard-codes this field to one value, and the credentials we actually issue do not carry it at all.
- Linked Data Signatures: the Proof Format Behind Your CredentialIt is not the proof format behind your credential, and the first honest thing this page can do is say so.
- Why More Solidus Holders Makes Your Presentations SaferThe unlinkability implementation described here is unaudited.
- Does Resolving Your DID Notify Anyone?In a great many identity systems, checking something about you contacts the party who issued it.
- What Credential Vendor Lock-In Actually Looks LikeThe sales version of this page would say a portable credential eliminates lock-in.
- Where Does Your Identity Data Actually Live?Solidus offers no data-residency guarantee, has no regional deployment option, and no signed agreement specifying where anything is stored.
- Can You Delete a DID? GDPR Article 17 vs. an Append-Only ChainNo, and Solidus has no erasure workflow, no appointed Data Protection Officer, and no completed Data Protection Impact Assessment.
- How a Credential Offer Arrives in Your InboxAnd the most important sentence on this page is a limitation, so it goes first: accepting an offer today marks it accepted.
- Can You Take Back a Credential You Already Shared?The unlinkability implementation described here is unaudited.
- Every Time Your Identity Was Presented: the Activity LogThe heading above is our content plan's, and it promises something this log does not contain.
- What Happens When You Scan a Credential Request QR CodeScanning does not tell you who is asking. The scanner checks that the code contains well-formed JSON of the expected shape and that one field is a string beginning with did:, and that is the entire…
- Can Anyone Look Up Your DID and See What You've Shared?Two questions, two different answers. Anyone can look up a Solidus identity DID, with no account and no permission: you can run the command yourself below.
- What Actually Happens When You Register a did:solidusYour private key is generated in your browser, signs the registration transaction there, and is never sent to us.
- Issuing a Verifiable Credential: What the SDK Actually SignsThe unlinkability implementation described here is unaudited.
- How a Relying Party Verifies a Credential a Holder PresentsThe SDK tells you a signature is valid. It does not tell you whether the issuer deserves your trust, and it will not fetch the issuer's key for you: you have to supply it.
- Identity Fragmentation Was Named Before the Vocabulary ExistedIn September 2017 a designer in Istanbul wrote an email describing a universal login instead of dozens of passwords, personal data held encrypted, and per-service control over which service could reach which part of it.
- What Okta's 2023 Breach and the EU's 2026 Wallet Mandate Have in CommonAnd the sentence that has to come next, before anything else: neither fact is evidence for us.
- The Cold-Start Problem in Decentralised IdentityThe rest of this page is why the question is fair, where the honest exception is, and what we are not going to pretend.
- Why Identity Only Does DIDs and Credentials, Not Payments, Storage, or SocialYou're trying to build: a new blockchain · an identity protocol · a wallet system · a file storage network · a payments platform · a social network · a content marketplace · a governance system · a…
- What a Reused Credential Costs, Compared to the First CheckWe cannot tell you, and the honest reason is not commercial secrecy: it is that we do not have a price.
- Proving You're Over 18 Without Showing an IDYes, in principle, and not the way most people assume. There is no zero-knowledge proof here.
- What It Costs to Put Your Brand on a Verifiable-Credential WalletWe are not going to give you a number, because there is no product here to price.
- Can I Add 'Sign In With Solidus' to My App Today?Yes. There is a working OpenID Connect issuer, and you can register a client without asking us.
- Will a Solidus Credential Work Inside an EU Digital Identity Wallet?The honest answer has two halves and most pages only print one.
- What You Are Actually Agreeing To When Someone Makes You a GuardianYou are agreeing that, together with enough other guardians, you can hand control of someone's identity to a new key.
- Verify a Selective-Disclosure Proof Yourself, Right NowOur BBS+ implementation is unaudited: that is the most important fact on this page.
- How to Estimate What Credential Reuse Is Worth to a High-Volume VendorAnd the honest headline before the arithmetic: the model is not your binding constraint today.
- Is Solidus Identity Ready for Production Use?No. Not for anything you would be harmed by losing, and not for anything a regulator, an auditor or a customer will ask you to justify.
- What "Registered in the W3C DID Method Registry" Actually Means, and What It Doesn'tIt means the name did:solidus is reserved and points at a published specification.
- What the Decentralized Identity Foundation Is, and What Membership Does Not BuyWe are an Associate Member, it is a paid tier, our logo is on their public page, and it certifies nothing about our software.
- The Trust over IP Layers, and Which Ones Solidus Actually OccupiesOne of four, and it is the bottom one. The Trust over IP model is the clearest way to see what a project like ours is and is not, which is why we use it, and why it is uncomfortable.
- SD-JWT VC: the Credential Format Solidus Actually IssuesIt is an IETF draft, not a published RFC, and our implementation of it is unaudited.
- OpenID4VCI and OpenID4VP: the Two Protocols an EU Wallet SpeaksOne of them we run in production today, on a different Solidus product.
- Who Actually Sets Decentralized Identity StandardsSix organisations, none of which is in charge, and a vendor can sound accredited by naming any of them.
- mdoc or SD-JWT VC? Two Credential Formats, Two Different WorldsWe issue one of them. The other is roadmap and not built.
- Your National eID Works Beautifully. Inside One Country's PortalThese systems are not bad. Most of them are excellent, and they solve the hard part, real identity verification at national scale, better than anything in this industry.
- What e-Devlet Proves, and Where That Proof StopsIt proves who you are to the Turkish state's own services, at national scale, and it does that well.
- Can a National ID Registry Issue a Portable Credential?We have no integration with any national registry, and this page is concept only.
- How Does a Credential Get to Your Wallet? DIDComm v2 vs OpenID4VCTwo rival answers to the same question, and Solidus has one of each, in two products that are not this one.
- Sovrin Shut Down. Skiff Was Killed. Bloom Left. Why Trust a New One?You should not trust us yet, and this page is not going to argue otherwise.