Skip to content
↑↓ to move · Enter to openEsc to close
Glossary · Identity

Decentralized identifier (DID)

Updated

The W3C Decentralized Identifiers (DIDs) v1.0 Recommendation, published on 19 July 2022, describes DIDs as a type of identifier that enables verifiable, decentralized digital identity. A DID has three parts: the did scheme, a method name, and a method-specific identifier.

Each DID method defines how its identifiers are created and resolved to a DID document containing keys and service endpoints.

Definition

A decentralized identifier (DID) is a W3C-standardized identifier of the form did:<method>:<method-specific-id> that its controller can create and prove control of cryptographically, without a central issuing authority.

Also known as: DID, W3C DID

How it relates to AgenID

An AgenID identifier is agenid:<ULID>, for example agenid:01J8Z3K3F2QZ9X6V7R4T8N2W5Y. It is not a DID, and v1.1.1 does not define a DID method. Where a DID method specifies its own resolution, AgenID resolves through its registry and cross-checks the operator key against the operator's own domain using two-path key discovery. The comparison covers the trade-offs.

Those two paths are the registry at GET https://www.agenid.com/v1/keys/<key-ulid> and the operator's https://<operator_domain>/.well-known/agenid/keys.json.

Why it matters

Both approaches aim for identities a verifier can check without trusting a single database. AgenID adds a fixed manifest schema for agents, with operator, purpose and disclosure fields, and a verification level model. The identifier is immutable for the life of the record and never reissued.

The reference deployment at agenid.com issues nothing above L1_REGISTERED today. L2 and higher require a VerificationAssertion signed by a root authority key, and that key has not been created yet.

What it does not mean

Neither a DID nor an AgenID, on its own, says what the identified agent is allowed to do. Identity and permission are separate questions. Each shows control of a key; neither is a statement that the controller is reputable.

Frequently asked questions

Can I use a DID as my AgenID?

No. The identifier must match agenid: followed by a 26-character ULID, and platform-native identifiers must not be encoded into it.

Is AgenID built on blockchain?

No. It uses Ed25519 signatures over RFC 8785 canonical JSON, a registry that cannot forge signatures, and the operator's own domain.

Could AgenID interoperate with DIDs?

This page makes no claim about future interoperability. The current spec is at github.com/AgenID-protocol/spec.

What agenid.com issues today

The reference deployment at agenid.com issues DECLARED and L1_REGISTERED only. L2_DOMAIN_VERIFIED and higher require a VerificationAssertion signed by a root authority key, and that key has not been created yet. L5 is reserved by the specification and is not issuable at all.

Identity is not permission

Which agent is acting and who declared it is one question. What that agent is allowed to do is another, and it stays with the party on the other side and with the operator. Protocol v1.1.1 defines no signed authorization object.

Sources

  1. W3C Decentralized Identifiers (DIDs) v1.0

Give your agent an identity

Register an agent in the browser — the signing key is generated on your device and never sent to AgenID — or resolve an existing AgenID and re-check its signature yourself.