Skip to Content
ConceptsDecentralized Identifiers

Decentralized Identifiers

A Decentralized Identifier (DID) is a globally unique identifier that is owned and controlled by the person or entity it represents — not by any central authority. Solidus DIDs follow the W3C DID Core specification and are registered on the Solidus blockchain.

DID Format

Every Solidus DID has the form:

did:solidus:<network>:<address>

For example:

did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR

The four parts are:

  • did — the URI scheme (required by the W3C standard)
  • solidus — the DID method, identifying the Solidus network as the registry
  • <network> — testnet or mainnet
  • <address> — a base58-encoded address derived from the public key

Corrected 2026-07-21. This page previously showed a three-segment form, did:solidus:<address>, with no network. That form has never been produced by the SDK or accepted by the chain — every did:solidus DID carries a network segment. Code written against the old example parsed DIDs incorrectly, and the Universal Resolver driver rejects the three-segment form with invalidDid.

Key Derivation

The address in a Solidus DID is derived from an Ed25519 public key through this process:

Ed25519 public key (32 bytes)
    ↓
BLAKE3 hash (32 bytes)
    ↓
Take first 20 bytes
    ↓
Base58 encode
    ↓
did:solidus:<network>:<result>

This is deterministic — the same public key always produces the same DID. The BLAKE3 hash ensures collision resistance while keeping addresses compact.

DID Document

Every DID has an associated DID Document stored on-chain. The document describes the public keys, authentication methods, and capabilities associated with the DID.

Here is a complete DID Document:

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/ed25519-2020/v1"
  ],
  "id": "did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR",
  "verificationMethod": [
    {
      "id": "did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR#key-1",
      "type": "Ed25519VerificationKey2020",
      "controller": "did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR",
      "publicKeyMultibase": "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
    }
  ],
  "authentication": [
    "did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR#key-1"
  ],
  "assertionMethod": [
    "did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR#key-1"
  ]
}

Document Fields

@context — JSON-LD context defining the vocabulary. Solidus uses the W3C DID v1 context and the Ed25519 2020 cryptographic suite.

id — the DID itself.

verificationMethod — an array of public keys associated with this DID. Each method has:

  • id — a fragment URI identifying this specific key
  • type — the key type (Ed25519VerificationKey2020 for Solidus)
  • controller — the DID that controls this key (usually the same DID)
  • publicKeyMultibase — the public key encoded in multibase format

authentication — references to verification methods that can be used to authenticate as this DID. Used in login flows and challenge-response protocols.

assertionMethod — references to verification methods that can be used to sign credentials. Used when this DID issues Verifiable Credentials.

DID Operations

Create

Creating a DID registers it on the Solidus blockchain via a DidCreate transaction. This is a one-time, irreversible operation.

import * as ed25519 from '@noble/ed25519'
import { createSdk } from '@solidus-network/sdk'
 
// Generate keys
const privateKey = ed25519.utils.randomPrivateKey()
const publicKey = await ed25519.getPublicKeyAsync(privateKey)
const privateKeyHex = Buffer.from(privateKey).toString('hex')
const publicKeyHex = Buffer.from(publicKey).toString('hex')
 
// Create SDK instance
const sdk = createSdk({
  mode: 'testnet',
  chain: {
    rpcUrl: 'https://rpc.solidus.network',
    signerPrivateKey: privateKeyHex,
    network: 'testnet',
  },
})
 
// Create the DID
const did = await sdk.did.create({
  publicKey: publicKeyHex,
  keyType: 'Ed25519VerificationKey2020',
})
 
console.log(did.id)
// did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR
console.log(did.transactionHash)
// 0x3a8f...c7d2

The transaction is submitted to the network, included in a block, and finalized after 3-chain confirmation (approximately 7.5 seconds).

Resolve

Resolving a DID retrieves its DID Document from the chain. This is a read-only RPC query that does not require a transaction.

const document = await sdk.did.resolve('did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR')
 
console.log(document.id)
// did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR
console.log(document.verificationMethod[0].type)
// Ed25519VerificationKey2020

You can also resolve DIDs directly via the JSON-RPC endpoint:

curl -X POST https://rpc.solidus.network \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "solidus_didResolve",
    "params": ["did:solidus:testnet:7Hk3mRtQZvNxP2bK9wYfJ4eD6cA5sLgR"],
    "id": 1
  }'

Deactivate

Deactivating a DID marks it as no longer active. This is an irreversible operation — once deactivated, the DID cannot be used to sign credentials or authenticate. Existing credentials issued by this DID remain verifiable but will show the issuer as deactivated.

const result = await sdk.did.deactivate(did.id)
 
console.log(result.deactivated)
// true
console.log(result.transactionHash)
// 0x9b2c...e4f1

After deactivation, resolving the DID returns a document with an empty verificationMethod array and a deactivated: true flag.

DID Lifecycle

A DID goes through these states:

Created → Active → Deactivated
  • Created — the DidCreate transaction has been submitted but not yet finalized
  • Active — the DID is on-chain and can be used for authentication and credential issuance
  • Deactivated — the DidDeactivate transaction has been finalized; the DID can no longer sign anything

There is no “update” operation for a DID Document in the current protocol version. If you need to rotate keys, you create a new DID and migrate your credentials.

Security Considerations

Private key management. The private key is the sole proof of ownership. If it is lost, the DID cannot be recovered. If it is stolen, an attacker can impersonate the DID owner. Store private keys in secure enclaves, hardware wallets, or encrypted storage.

Key rotation. The current protocol version does not support adding or removing keys from a DID Document. Key rotation requires creating a new DID and having credentials re-issued. This is a deliberate simplicity tradeoff for the initial protocol version.

DID correlation. A DID is a persistent, public identifier. Using the same DID across many services allows those services to correlate your activity. For privacy-sensitive use cases, consider using different DIDs for different contexts.

Next Steps

Last updated on
ArchitectureVerifiable Credentials