Identity

A DID (decentralized identifier) is the root of identity in The Wired. It is a globally unique string that resolves to a document listing the keys and services that identity controls.

Methods

The method is the part of a DID after did:. It determines how the DID resolves.

• did:key is derived entirely from a cryptographic keypair, with no server or domain required. It is portable and self-contained, but not recoverable if the key is lost. Clients generate one for a person by default.
• did:web is tied to a domain, resolved by fetching https://<domain>/.well-known/did.json. It is recovered through ordinary domain administration, and can advertise services through standard web infrastructure. Servers use one for themselves.

DID Documents

Resolving a DID returns its DID document: a signed record naming the key used to authenticate as that identity, and the services it runs. A store advertises itself there — its network address, and the ID of the identity’s root document.

// https://example.com/.well-known/did.json
{
  "id": "did:web:example.com",
  "verificationMethod": [{
    "id": "did:web:example.com#key",
    "type": "JsonWebKey2020",
    "controller": "did:web:example.com",
    "publicKeyJwk": { "...": "..." }
  }],
  "authentication": ["did:web:example.com#key"],
  "service": [{
    "id": "wds",
    "type": ["WDSEndpoint"],
    "serviceEndpoint": ["<network address>"]
  }]
}