What is a decentralized identifier (DID)?

Decentralized identifiers are a foundational primitive of the self-sovereign identity (SSI) stack. Understanding DIDs is prerequisite knowledge for building with Autheo's TheoID identity layer.

Direct Answer

A decentralized identifier (DID) is a globally unique identifier controlled by its subject using cryptographic keys, with no central registry required. DIDs are standardized by the W3C DID Core specification (published July 2022) and resolve to DID Documents containing public keys, service endpoints, and authentication methods. Unlike traditional identifiers such as email addresses or usernames, a DID cannot be revoked by a third party.

Understand the broader Autheo platform

This answer covers one part of the Autheo ecosystem. To understand how this capability fits into the full platform, start with the core Autheo overview and architecture pages.

Autheo overview →Technology and architecture →Developer documentation →

How DIDs work

A DID is a string in the format did:method:method-specific-id. The method specifies which blockchain or distributed system resolves the identifier. For example, did:indy:sovrin:7Tqg6BwSSWapxgUDm9KKgg resolves on the Hyperledger Indy network. The resolver fetches a DID Document containing the public keys needed to verify credentials signed by that DID.

DID methods

Each DID method defines how DIDs are created, resolved, updated, and deactivated on a specific system. Common methods include did:key (local key pairs), did:web (web-hosted documents), did:ethr (Ethereum-based), did:indy (Hyperledger Indy), and did:cheqd (Cosmos-based). Autheo uses TheoID as its native identity layer, providing a post-quantum sovereign DID method anchored at the OS layer.

Verifiable credentials and DIDs

DIDs are foundational to verifiable credentials (VCs), the W3C standard for tamper-evident digital credentials. An issuer signs a credential using their DID's private key; a verifier resolves the issuer's DID to fetch the public key and verify the signature. This eliminates the need for a central credential authority.