Expand description
Passive portable authentication and delegation contracts, independent of runtime, storage and Candid.
Principal is owned by IC Platform’s explicit principal feature; external IC APIs convert at their boundary.
Transport schemas belong to endpoint adapters, outside these domain contracts.
Decoding these values does not verify a proof or establish authority. Hosts must obtain expected audience, caller, time and issuer policy independently. Application credentials are not IC ingress delegations.
Modules§
- limits
- Structural protocol ceilings shared by validation and bounded transport. Hosts may impose tighter policy; transport allocation budgets are separate.
Structs§
- Audience
Id - Exact network-qualified audience, with existing protocol field labels. The host owns the meaning and trusted source of both identifiers; this type contains no fleet topology, membership, derivation or installation policy.
- Auth
Request Metadata - Auth
Role - Canonical role label, checked at construction and deserialization. The grammar matches the existing signed protocol; it adds no case folding, normalization, built-in roles or implicit role authority.
- Canonical
Id - Exactly 32 identity bytes, represented as lowercase hexadecimal on the wire. No sentinel bytes are reserved by this protocol. A host must compare this value with its protected identity, never enroll trust from a client claim.
- Chain
KeyBatch Header V1 - Chain
KeyBatch Witness V1 - Chain
KeyDelegation Cert V1 - Chain
KeyKey Id - Chain
KeyRoot Signature V1 - Delegated
Role Grant - Delegation
Cert - Delegation
Proof - IcCanister
Signature Proof V1 - IcChain
KeyBatch Signature Proof V1 - Logout
Request - The host authenticates the caller and selects its installed trust domain.
- Portable
Claims - Decoded signed material, not verified identity, enrollment or permission. Login windows survive renewal unchanged; admission expiry is distinct from both the absolute login deadline and the receiver’s session lease.
- Portable
Credential - Unauthenticated portable credential transport.
claimscontains the exact canonical signed bytes, not a Candid encoding ofPortableClaims. Hosts must bound outer decoding and verify against protected enrollment. - Principal
- Generic ID on Internet Computer.
Enums§
- Admission
Refusal - A receiver refusal. Only
NotYetValididentifies a future-start retry hint; it grants no clock grace, new issuance, deadline extension or authorization. The caller owns bounded retries of the same credential and login generation. - Chain
KeyAlgorithm - Chain
KeyBatch Witness Step V1 - Delegation
Audience - Identifier
Error - Invalid protocol identifier syntax. This says nothing about authorization.
- Issuer
Proof Algorithm - Issuer
Proof Binding - Logout
Result - Acknowledges only this destination’s committed revocation, never global logout.
- Logout
Unavailable - No successful revocation is implied; transport failures also remain unknown.
- Portable
Mechanism - Claimed proof mechanism. Only protected enrollment can authorize its use.
- Portable
Proof - Transport selects proof material, never trusted authority or signing custody. Ed25519 signatures are exactly 64 bytes at verification; issuer keys are not carried here. Certified proofs reuse the existing Root and IC proof owners.
- Root
Proof