{
 "id": "lws10-authn-ssi-cid",
 "name": "LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers",
 "acronym": "LWS-SSI-CID",
 "aliases": [
  "lws10-authn-ssi-cid",
  "LWS Self-signed Identity authentication suite"
 ],
 "collisions": [],
 "step": "identify",
 "parties": [
  "agent-site"
 ],
 "form": "document-format",
 "track": "w3c",
 "scope": "general",
 "question": "How can an agent that signs its own JWT identity tokens authenticate to a Linked Web Storage server, with verifiers validating the token against the agent's controlled identifier document?",
 "analog": "Self-issued OpenID-style JWT client authentication, where the public key is resolved from the subject's own HTTPS or DID controlled identifier document.",
 "origin": {
  "org": "W3C Linked Web Storage Working Group",
  "date": null
 },
 "governance": "W3C Linked Web Storage Working Group, Recommendation track, under the W3C Patent Policy and the 18 August 2025 W3C Process Document",
 "native_status": "W3C Working Draft 15 October 2026; published by the Linked Web Storage Working Group as a Working Draft using the Recommendation track. The page also says: This is an unofficial proposal.",
 "phase": "draft",
 "implementation": "unknown",
 "adoption": {
  "level": "unmeasured",
  "by": null,
  "probe_run": null
 },
 "version": {
  "label": "W3C Working Draft",
  "date": "2026-10-15"
 },
 "spec_url": "https://www.w3.org/TR/lws10-authn-ssi-cid/",
 "discovery": {
  "mechanism": "The verifier dereferences the JWT sub claim (an HTTPS URI or DID URI) to fetch the controlled identifier document and selects a verification method by the JWT kid header.",
  "path": null
 },
 "probe": {
  "method": "NONE",
  "path": "",
  "parse": "",
  "on_absent": "Support cannot be observed passively. It would require an authenticated request to an LWS authorization server using a self-issued JWT."
 },
 "evidence": [
  {
   "claim": "W3C Working Draft of 15 October 2026 defining an authentication suite for Linked Web Storage that lets clients sign their own identity tokens (JWT) validated through W3C Controlled Identifiers documents.",
   "label": "REPORTED",
   "url": "https://www.w3.org/TR/lws10-authn-ssi-cid/",
   "date": "2026-10-15"
  }
 ],
 "summary_md": "Defines an authentication suite for the Linked Web Storage (LWS) protocol for agents that can sign their own identity tokens. The credential is a signed JWT in which sub, iss and client_id carry the same URI, with exp and iat required and alg none forbidden. Verifiers dereference the subject URI to get a W3C Controlled Identifier document and check the signature against the verification method matching the kid. It works with HTTPS URIs and DID URIs, and uses the token type urn:ietf:params:oauth:token-type:jwt.",
 "part_of": null,
 "group": null,
 "candidate": true,
 "confidence": 0.8,
 "use_cases": [
  "prove-agent-identity"
 ],
 "audience": [
  "agent-builder",
  "platform",
  "standards-body"
 ],
 "pairs_with": [],
 "prerequisites": [],
 "dispute": null,
 "last_verified": "2026-10-19",
 "history": [
  {
   "date": "2026-10-19",
   "note": "auto-drafted candidate from exa (https://w3.org/TR/lws10-authn-ssi-cid)"
  }
 ],
 "watch": [
  {
   "type": "page",
   "url": "https://w3.org/TR/lws10-authn-ssi-cid"
  }
 ],
 "freshness": "current"
}