The World Wide Web Consortium (W3C) has released the first public working draft of the Digital Credentials API, a new specification designed to bring cryptographically-verifiable digital credentials to the browser. Published this week by the Federated Identity Working Group, the draft represents a significant step toward native support for digital identity verification across web platforms.
Tim Cappalli, Identity Standards & Strategy Lead at Okta and one of the editors of the specification, said the effort reflects extensive collaboration across multiple organizations, including the FIDO Alliance, OpenID Foundation, and W3C itself.
“After more than 3 years of work and collaboration across FIDO Alliance, OpenID Foundation, and of course the W3C, the first public working draft of the Digital Credentials API has been published,” he wrote in an online post. “We have more work to do to get to Candidate Recommendation, but this is a really important milestone!”
The Digital Credentials API aims to address a long-standing gap in the web architecture by introducing a browser-level interface for websites to request and users to manage cryptographically secure credentials. The proposal extends the Credential Management Level 1 specification and references the Verifiable Credentials Data Model v2.0, laying the groundwork for future implementations that could support advanced privacy features like zero-knowledge proofs for unlinkability. However, the draft currently frames these capabilities as anticipated goals rather than mandatory components.
Technical Features and Browser Adoption
The draft specification outlines standardized flows for credential issuance and presentation, a protocol-agnostic architecture supporting various credential exchange formats, and robust guidance on security and privacy. Topics addressed include mitigating user tracking, preventing credential correlation across sites, and securing transactions across devices.
Browser support remains varied. Google Chrome has initiated an origin trial limited to Android devices starting in version 128, while Apple unveiled support for the API in the beta release of Safari 26 announced at WWDC 25. Apple’s implementation focuses initially on ISO mdoc (mobile driver’s license) workflows. Meanwhile, Mozilla’s Firefox team has expressed skepticism about potential privacy risks and has not committed to implementing the specification.
Recent demonstrations organized by the OpenID Foundation have shown early interoperability experiments between digital wallets using protocols like ISO mdoc and OpenID4VP/VCI. However, no formal cross-vendor interoperability reports have been publicly released to date, leaving the maturity of practical implementations somewhat unclear.
Governance and Next Steps
The publication of the draft follows a February 2025 decision by the W3C Council, which overruled a formal objection that raised privacy and tracking concerns but instructed the Working Group to strengthen privacy mitigations as the draft progresses. The Digital Credentials API is expected to undergo multiple revisions in response to feedback gathered during ongoing browser trials and industry testing.
Current projections suggest that the specification could advance to Candidate Recommendation status in 2026 or 2027, potentially aligning with the timeline for Europe’s rollout of the EU Digital Identity Wallet, which mandates interoperable digital credential systems across member states.
This push toward standardized digital identity solutions also coincides with broader industry trends, such as the FIDO Alliance’s predictions for widespread passkey adoption and Visa’s recent integration of passkeys for online payments. These developments collectively point toward a future where secure, privacy-preserving identity verification becomes an integral part of digital interactions on the web.
Sources: W3C Digital Credentials API Draft, W3C News, W3C Blog, Corbado, OpenID Foundation
–
By Cass Kennedy & Ali Nassar-Smith
