How to Estimate What Credential Reuse Is Worth to a High-Volume Vendor

And the honest headline before the arithmetic: the model is not your binding constraint today. No unaffiliated party has ever accepted a Solidus credential, so the acceptance rate in any calculation you build is currently zero, and a zero there makes the rest of the model decorative.

Read this as the framework to apply when that changes, and as the questions to put to anyone selling you reuse, including us.

The four numbers, all of them yours

You already have all four. We have none of them.

C, what one identity check costs you today. Vendor fee plus the human minutes plus the support load. Most vendors underestimate this because the human and support parts sit in a different budget line from the vendor invoice.
V, checks per period.
R: the share of those checks that are on someone already verified, by you or by an issuer you would accept. This is the number the whole case rests on, and it is the one nobody measures before starting.
D, what you lose to drop-off at the verification step. Abandoned sign-ups are usually a larger line than the vendor fee, and they are invisible in the invoice.

The gross prize is C × V × R, plus whatever share of D a shorter flow recovers. That is arithmetic, not a claim.

The three subtractions people forget

Any honest model then subtracts:

P, what the reuse costs. We do not have a price, so this term is unknown for us specifically. Why, and what our own material says about it: the short version is that no figure of ours has survived contact with a buyer, because there has been no buyer.
Integration and its ongoing cost. A verifier is code you own and maintain.
The share you cannot accept anyway. Regulatory or internal policy may require your own check regardless of what a credential says, and reuse never discharges your obligation; the decision stays yours. That is not a Solidus limitation, it is what accepting somebody else's attestation means.

If R is small, the whole exercise is noise. Measure R first, on your real traffic, before anyone builds anything.

The part where the arithmetic favours the idea, honestly

The asymmetry is real and it is not a claim about us. The first check is expensive because it involves a document, a person, and often a human. Accepting the resulting credential is a signature check and some hash comparisons, on your own hardware, at your own compute cost, with no call to any vendor.

That is a property of public-key cryptography, true of any conformant implementation, and it would be true if we did not exist.

What is available today, so you can test it rather than model it

You can measure the verification side yourself this afternoon, which is more useful than any estimate we could give you:

$ npm i @solidus-network/[email protected]      # clean directory, no account

Verification is a library call. Re-verified this session with a wrong-key control that correctly fails, and the selective-disclosure proof endpoint answered an unauthenticated request end to end.

So the cost of the check is measurable by you, today, without talking to us. That is the one input we can hand over honestly.

The questions to ask any vendor selling you reuse

What share of my traffic is actually re-verifiable? If they answer without seeing your data, they are guessing.
Who has accepted this in production? Ours: nobody.
What happens to my liability? Nothing. Reuse does not move it.
What does it cost, and is that price settled? Ours is not.
Can I verify without you in the path? Yes: that is the one we can demonstrate.