Identity

A DID (decentralized identifier) is the root of identity in The Wired: a globally unique handle that resolves to a document you control. How far that control extends is a property of the DID’s method.

Methods

A DID’s method determines how it resolves.

• did:key is derived entirely from a cryptographic keypair, with no server or domain required — portable and self-contained, but not recoverable if the key is lost. This is what a client generates for a person by default.
• did:web is tied to a domain, resolved by fetching https://<domain>/.well-known/did.json. Recoverable through ordinary domain administration, and able to advertise services through standard web infrastructure. This is what a server uses for itself.

DID Documents

Resolving a DID returns its DID document: a signed record naming the key used to authenticate as that identity, and the services it runs. A store advertises itself there — its network address, and the ID of the identity’s root document.

// https://example.com/.well-known/did.json
{
  "id": "did:web:example.com",
  "verificationMethod": [{
    "id": "did:web:example.com#key",
    "type": "JsonWebKey2020",
    "controller": "did:web:example.com",
    "publicKeyJwk": { "...": "..." }
  }],
  "authentication": ["did:web:example.com#key"],
  "service": [{
    "id": "wds",
    "type": ["WDSEndpoint"],
    "serviceEndpoint": ["<network address>"]
  }]
}