Skip to content

Add 'kid' and 'iss' parameters to L2 JWT specification + risk_data #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
fahads9 wants to merge 1 commit into from
+5 −1
Closed

Add 'kid' and 'iss' parameters to L2 JWT specification + risk_data #21

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion spec/credential-format.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,13 +152,16 @@ L2 contains an `sd_hash` binding it to the serialized L1.
|-----------|------|----------|-------------|
| `alg` | string | REQUIRED | MUST be `"ES256"`. |
| `typ` | string | REQUIRED | MUST be `"kb-sd-jwt"` (Immediate mode) or `"kb-sd-jwt+kb"` (Autonomous mode). |
| `kid` | string | REQUIRED | User's key identifier from the corresponding L1 cnf.jwk.kid. Verifiers resolve the L2 signing key directly from L1 cnf.jwk.|


### 4.3 JWT Payload — Always-Visible Claims

| Claim | Type | Required | Description |
|-------|------|----------|-------------|
| `nonce` | string | REQUIRED | Cryptographically random nonce. Prevents replay attacks. |
| `aud` | string | REQUIRED | Intended audience URI. MUST identify the payment network or verifier. |
| `iss` | string | REQUIRED | Credential Provider identifier URI. Identifies the wallet or credential provider that signed the L2. MUST be a stable, dereferenceable URI. |
| `aud` | string | REQUIRED | Intended audience URI. MUST identify the agent or verifier. |
| `iat` | integer | REQUIRED | Issued-at time (Unix timestamp). |
| `exp` | integer | REQUIRED | Expiration time. Immediate mode: SHOULD be no more than 15 minutes from `iat`. Autonomous mode: SHOULD be no more than 30 days from `iat`; SHOULD use the shortest duration appropriate for the use case. |
| `sd_hash` | string | REQUIRED | Base64url-encoded SHA-256 hash of the serialized L1 SD-JWT string: `B64U(SHA-256(ASCII(serialized_L1)))`. |
Expand Down Expand Up @@ -249,6 +252,7 @@ and binds the agent's key for L3 delegation.
| `cnf` | object | REQUIRED | Confirmation claim containing `cnf.jwk` with the agent's public key and `cnf.kid` with a key identifier. MUST match the `cnf` in the checkout mandate of the same mandate pair. |
| `payment_instrument` | object | REQUIRED | Payment instrument descriptor. See §4.4.2 for structure. |
| `constraints` | array | REQUIRED | Array of constraint objects bounding the agent's payment authority. MUST contain at least one constraint. |
| `risk_data` | object | OPTIONAL | A map of relevant risk signals collected by the credential provider at time of mandate creation |

> **Note**: Recurrence terms (subscription setup, agent-managed recurring purchases) are
> expressed as constraint types (`payment.recurrence`, `payment.agent_recurrence`) within
Expand Down
Loading