Credential Mediator

Formally defined by the World Wide Web Consortium (W3C), a Credential Mediator is a standardized API and service that manages requests for verifiable credentials from relying parties (websites) and facilitates their secure retrieval from a user's digital wallet or credential store. Its primary function is to enable a seamless, user-controlled login flow, replacing traditional passwords with cryptographic proofs. This component is central to the Web Authentication (WebAuthn) and Verifiable Credentials ecosystems, providing a privacy-preserving bridge between web applications and a user's identity assets.

The mediator operates on a user-agent level, typically within a browser or operating system. When a website requests a credential (e.g., for login), the mediator prompts the user, who can then select which wallet to use and which specific credential to share. This process, known as the credential selection ceremony, ensures the user maintains sovereign control over their data. The mediator never sees the private cryptographic keys; it only facilitates the request and response protocol, enforcing user consent and minimizing data exposure through techniques like selective disclosure.

A key implementation is the Web Credentials API, which browsers like Chrome and Edge have integrated. For developers, using a Credential Mediator means implementing the navigator.credentials.get() and navigator.credentials.create() calls, which the mediator services. This abstracts the complexity of direct wallet communication, allowing standard web apps to request passkeys, digital driver's licenses, or educational certificates without custom integrations. The mediator handles the secure channel and protocol compliance, such as the W3C Verifiable Credentials Data Model.

The architectural role of the Credential Mediator is crucial for decentralized identity. It solves the 'wallet discovery' problem by providing a standard interface that all compliant wallets can plug into, preventing vendor lock-in. By separating the wallet (where credentials are stored) from the relying party (which uses them), it enhances security and portability. This design is foundational for SSI (Self-Sovereign Identity) systems, where the user, not the service provider, is the central authority over their digital identity.

A credential mediator acts as a secure, cloud-hosted service or a personal agent that manages the flow of Verifiable Credentials (VCs). Its primary function is to receive, store, and present credentials on behalf of a user (the holder) without the verifier needing direct access to the user's wallet or personal device. This is achieved through standardized protocols like W3C DIDComm or OpenID for Verifiable Credentials (OID4VC), which define how encrypted messages containing credential presentations are routed. The mediator ensures the user maintains control by requiring explicit consent for each disclosure, acting as a privacy-preserving relay rather than a central data repository.

The core operational flow involves three key interactions. First, an issuer sends a signed VC to the user's mediator endpoint, which stores it encrypted. When a verifier (e.g., a website) requests proof, it sends a Verifiable Presentation Request to the mediator. The mediator then forwards this request to the user's authenticator app (like a mobile wallet) for approval. Upon user consent, the wallet creates a Verifiable Presentation, signs it, and sends it back through the mediator to the verifier. This decouples the always-online mediator from the user's signing keys, which remain securely on their personal device.

This architecture solves critical usability and privacy challenges. It allows for push notifications for credential offers and presentation requests, enabling seamless interactions even when the user's wallet app is closed. Crucially, it prevents verifiers from correlating a user's activity across different services, as the mediator can use different DID identifiers for each interaction. Common implementations include Cloud Agents (e.g., in the Indicio Network or Microsoft Entra Verified ID) and Edge Agents running on user-controlled servers, balancing convenience with sovereignty.

In a typical Verifiable Credential (VC) flow, a user must present a credential from their decentralized identifier (DID) wallet to a service for verification. Without a mediator, this direct presentation can inadvertently expose the user's persistent DID or wallet address, creating a privacy leak and enabling unwanted correlation across different services. The Credential Mediator solves this by inserting itself as an anonymizing relay. The user's wallet communicates only with the mediator, which then forwards the presentation to the verifier, effectively decoupling the user's identity from the transaction.

The mediator's architecture is built around the W3C's DIDComm messaging protocol, which provides secure, encrypted peer-to-peer communication. When a verifier requests a credential, it sends this request to the mediator's public endpoint. The mediator, which already has an established connection with the user's wallet, forwards the request. The wallet prepares the verifiable presentation, signs it, and sends it back to the mediator. Crucially, the mediator strips any identifying routing information before passing the presentation to the verifier, ensuring the verifier only sees the credential proof, not the source.

This model enables powerful privacy patterns like unlinkable presentations. A user can prove they are over 18 to multiple different online services, and without a mediator, each service could theoretically collude to track the user via their public DID. With a mediator acting as a shared, anonymous proxy, each presentation appears to come from the same mediator, making it computationally infeasible for verifiers to link the requests back to a single individual. This preserves user privacy while maintaining the cryptographic trust of the underlying credentials.

Common implementations of this pattern include cloud-based mediators, which offer high availability for everyday applications, and local mediators, such as an agent running on a user's own device for maximum control. Projects like the DIF's Identity Hubs and ACA-Py agents utilize this mediator pattern. The role is essential for scaling decentralized identity systems, as it separates the concerns of credential management from the privacy requirements of presentation, allowing both user-centric control and practical, correlation-resistant authentication on the web.