DID Management

Understanding DIDs

What is a DID?

A Decentralized Identifier (DID) is a globally unique identifier for your organization that:

You fully control (no central authority can take it away)
Can be verified cryptographically
Links to a DID Document containing your public keys and service endpoints
Serves as your organization’s digital identity

Think of it like your organization’s official digital address that proves who you are. This setup is usually only needed once as the did never changes and organizational management is implemented with key management within the DID.

DID Methods Supported

The wallet supports two types of DIDs:

did:web

A did:web identifier names a website. The domain is part of the identifier, and anyone checking it downloads the DID document from that domain. The method is specified by the did:web method.

The identifier is a domain, optionally followed by a path. Colons after the domain are path segments:

Domain only. did:web:vc.gs1.org resolves to https://vc.gs1.org/.well-known/did.json. This is GS1 Global Office’s identifier. That document is already published, and it is the root of the GS1 trust chain.
Domain and path. Each colon after the domain becomes a slash, and the document is did.json at the end of that path. did:web:vc.gs1.org:mo:swiss resolves to https://vc.gs1.org/mo/swiss/did.json. The file is still on the Global Office domain.

The DID document publishes the public keys. The private key stays in the wallet. A path on the host’s domain is how one wallet publishes an identifier for another organisation. Member Organisations normally prefer their own domain, for example did:web:vc.gs1.ch, by forwarding that domain to the wallet or by storing a copy of the document. A path on the host’s domain is the practical form for member-company identifiers when a Member Organisation or Global Office hosts the wallet. See Publishing an identifier on your own domain.

Recommended for organisational identities
The domain is listed in company settings before verifiers resolve it

did:key

Self-contained identifier based on a cryptographic key
No domain required
Useful for temporary or private identities
Less discoverable than did:web

Creating Your First Identity

Opening Identities

Click Identities in the main menu
The page title is Identity Management
You see the identifiers that already exist, or an empty state

If Add identity is disabled, your account cannot create identities. Ask an administrator.

Add a default identity

Add default creates the usual did:web for this company, from the wallet host and the company name. Use it when you do not need a custom domain. The button is unavailable once that default identity already exists.

Add a custom identity

Click Add identity
Enter a domain, with an optional path (for example example.com or example.com/issuer)
The dialog shows the resulting DID, such as did:web:example.com:issuer
Click Add identity

The domain should be one your company controls. Configure it under Company Settings before verifiers resolve a did:web on that domain.

did:key is still a valid identifier method in the wallet. This screen does not create one. Add default and Add identity both create did:web.

Add a key

A new identity needs at least one key before it can sign.

On the identity, click Add Key
Follow the steps in Key Management
The public key is written into the DID document

Viewing Your Identities

Search the list with Search Identity.

Each identity shows its DID, whether that DID resolves, and the keys attached to it. Open the identity for the DID document. Open a key menu and choose Details for the public key, purposes, and controller groups.

The wallet checks resolution automatically:

Success: the DID document can be fetched
Warning: hover the status to read why resolution failed

For did:web, resolution fails when the domain is not published or the DID document is not at the expected URL. Ask an administrator if that happens.

Deleting an Identity

Open the identity details
Open the menu and choose Delete DID
Confirm