Digital Credentials API

[wseltzer]

こんにちは TAG-さん!

The Federated Identity on the Web WG is requesting a TAG review of the Digital Credentials API.

This document specifies an API to enable user agents to mediate presentation and issuance of digital credentials such as a driver's license, government-issued identification card, and/or other types of digital credential . The API builds on Credential Management Level 1 as a means by which to request or issue a digital credential from a user agent or underlying platform.

• Explainer¹: The WG recommends the introduction to the spec as explanation of its purpose and use.

• Specification: https://www.w3.org/TR/digital-credentials/

• WPT Tests: https://github.com/web-platform-tests/wpt/tree/master/digital-credentials

• User research:

• Security and Privacy self-review²: https://github.com/w3c-fedid/digital-credentials/blob/main/horizontal-reviews/security-privacy.md

• GitHub repo: https://github.com/w3c-fedid/digital-credentials/

• Primary contacts:

  • Marcos Caceres ( Apple Inc. ), editor @marcoscaceres
  • Tim Cappalli ( Okta ), editor @timcappalli
  • Mohamed Amir Yosef ( Google Inc. ), editor @mohamedamir
  • Heather Flanagan (Spherical Cow Consulting), co-chair @hlflanagan
  • Wendy Seltzer (Invited Expert), co-chair @wseltzer
  • Simone Onofril (W3C), team contact @simoneonofri

• Organization/project driving the specification: W3C FedID WG

• This work is being funded by: Apple and Google have led much of the investment in this API in their respective browsers, but many others have also contributed

• Primary standards group developing this feature: W3C

• Group intended to standardize this work: same

• Incubation and standards groups that have discussed the design:

  • WICG Digital Credentials incubation: IdentityCredential WICG/proposals#105, https://github.com/WICG/identity-credential
  • OpenID, OpenID4VP: https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#dc_api

• Multi-stakeholder support³:

  • Chromium comments: https://chromestatus.com/feature/5166035265650688/activity https://developer.chrome.com/blog/digital-credentials-cross-device-ot , https://developer.chrome.com/blog/digital-credentials-api-origin-trial#participate_in_the_origin_trial
  • Mozilla comments: Digital Credentials mozilla/standards-positions#1003
  • WebKit comments: Digital Credentials API WebKit/standards-positions#332 <!-- And/or other places they've given feedback →
  • Credential Considerations draft: https://github.com/w3c/credential-considerations/blob/main/credentials-considerations.md

• Major unresolved issues with or opposition to this specification: W3C Council Report approving recharter, recommends ongoing work to mitigate the objections: https://www.w3.org/2025/02/council-report-fedid-dig-cred.html Issues have been opened in the spec to discuss and address objections

• Status/issue trackers for implementations⁴: https://digitalcredentials.dev/docs/ecosystem-support

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• Previous early design review, if any: N/A
• Relevant time constraints or deadlines: Apple has announced the API will ship in iOS 26 in September and Chrome is aiming to ship in version 140 in September, but both implementers have indicated flexibility in evolving with the specification where possible.

The FedID WG is tracking this horizontal review w3c-fedid/digital-credentials#230

Thank you!

---

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1119

[lolaodelola]

Explainer: https://github.com/w3c-fedid/digital-credentials/blob/main/explainer.md

[wseltzer]

The Working Group chose not to include the explainer @lolaodelola linked above because it is outdated (it reflects an early proposal, before WG adoption). We're discussing retiring the explainer and keeping updates in the non-normative introduction to the spec itself.

[marcoscaceres]

Apologies, TAG! The working group is currently blocked getting consensus on this PR:
w3c-fedid/digital-credentials#306

Which, once it lands, will allow us to actually add the algorithms. The algorithm are more or less written (I have them locally), but we can't send them as they depend on the Coordinator and Client model.

I expect to land that in the next few days... just waiting on confirmation that other implementers do the same thing. It should be easily demonstrable with a couple of tests.