# LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers LWS-SSI-CID

[2 · Identify](/category/identify/)
Candidate · auto-drafted, unreviewed · confidence 80%

| LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers |
| --- |
| Category | [Identify](/category/identify/) |
| Governed by | W3C Linked Web Storage Working Group, Recommendation track, under the W3C Patent Policy and the 18 August 2025 W3C Process Document |
| Status | W3C Working Draft 15 October 2026; published by the Linked Web Storage Working Group as a Working Draft using the Recommendation track. The page also says: This is an unofficial proposal. |
| Phase | draft |
| Implementation | unknown |
| Adoption | unmeasured |
| Version | W3C Working Draft (2026-10-15) |
| Specification | [https://www.w3.org/TR/lws10-authn-ssi-cid/](https://www.w3.org/TR/lws10-authn-ssi-cid/) |
| Found at | The verifier dereferences the JWT sub claim (an HTTPS URI or DID URI) to fetch the controlled identifier document and selects a verification method by the JWT kid header. |
| Last checked | 2026-10-19 |
| Freshness | current · checked 2026-10-19 |
| Solves | Prove an agent's identity |

LWS 1.0 Authentication Suite: Self-signed Identity using Controlled Identifiers (LWS-SSI-CID) is an agentic-web standard (document format) at step 2, Identify, governed by W3C Linked Web Storage Working Group, Recommendation track, under the W3C Patent Policy and the 18 August 2025 W3C Process Document; its own status is "W3C Working Draft 15 October 2026; published by the Linked Web Storage Working Group as a Working Draft using the Recommendation track. The page also says: This is an unofficial proposal." (draft). It answers: How can an agent that signs its own JWT identity tokens authenticate to a Linked Web Storage server, with verifiers validating the token against the agent's controlled identifier document? Adoption is unmeasured, last verified 2026-10-19.

[Identify](/category/identify/) Defines an authentication suite for the Linked Web Storage (LWS) protocol for agents that can sign their own identity tokens. The credential is a signed JWT in which sub, iss and client_id carry the same URI, with exp and iat required and alg none forbidden. Verifiers dereference the subject URI to get a W3C Controlled Identifier document and check the signature against the verification method matching the kid. It works with HTTPS URIs and DID URIs, and uses the token type urn:ietf:params:oauth:token-type:jwt.

## Discovery and probe

The verifier dereferences the JWT sub claim (an HTTPS URI or DID URI) to fetch the controlled identifier document and selects a verification method by the JWT kid header.

```
NONE
parse:
on absent: Support cannot be observed passively. It would require an authenticated request to an LWS authorization server using a self-issued JWT.
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-19 — auto-drafted candidate from exa (https://w3.org/TR/lws10-authn-ssi-cid)

## Instances

No instances recorded yet.

## See also

## References

- W3C Working Draft of 15 October 2026 defining an authentication suite for Linked Web Storage that lets clients sign their own identity tokens (JWT) validated through W3C Controlled Identifiers documents. — [https://www.w3.org/TR/lws10-authn-ssi-cid/](https://www.w3.org/TR/lws10-authn-ssi-cid/) (2026-10-15) REPORTED

[JSON](/data/protocols/lws10-authn-ssi-cid.json) · [Markdown](/protocols/lws10-authn-ssi-cid/index.md)