Digital Credentials API first draft published by W3C

A first public working draft of the Digital Credentials API from W3C has been published by the Federated Identity Working Group, providing a way for people to exchange Verifiable Credentials.

The release follows the publication of version 2 recommendations for the Verifiable Credentials standards by the W3C in May.

The API enables users to consent to share credentials they carry in a digital wallet when requested to by a website.

W3C notes in the announcement that for the system to work and be adopted, the user experience has to be excellent. That goes for understanding what the website is requesting, selecting the right credential, and adding credentials to the digital wallet. The browser is the tool “uniquely positioned to support that experience,” W3C says. A blog post notes that the exchange can be carried out through a different kind of user agent, however.

The Digital Credentials API has been through extensive incubation, and implemented by early adopters Google and Apple.

The Working Group acknowledges that the first draft has some security and privacy issues to work through. One example is how to balance data privacy with secure credential selection. The expectation is that credentials will be encrypted and digital signed by wallets before they are delivered to the user agent (probably a browser) through the API, the issue of unlinkability remains.

The blog post concludes with a call for more participants in the Federated Identity Working Group to help with further development.

The broader ecosystem of digital wallets will be enabled by standards from other organizations, like the FIDO Alliance, OpenID Foundation, IETF and ISO, which are being drawn together by the European Union Digital Identity (EUDI) Wallet initiative. A Global Digital Collaboration conference was held by the Open Wallet Foundation this week to advance that collaboration.

Article Topics

API  |  Digital Credentials API  |  digital ID  |  W3C  |  W3C standards