Vouch for something once. Let the world check it forever.

Your own name on the internet, not ours

Your credentials are signed by you — under your own domain, resolvable at your own address. Not a sub-account of ORBIS. The verifier reads your domain to check the signature, and never reads ours.

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/jws-2020/v1"
  ],
  "id": "did:web:orbis.id",
  "verificationMethod": [
    {
      "id": "did:web:orbis.id#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "MupKZa26RgQMQasnNxv4eDIS7XzIpGfDA4a9Y4TJvYY", "y": "oo_fTfpVOyJSpQmS9VaMuby4WCi55pzDhd0BklllVYc" }
    },
    {
      "id": "did:web:orbis.id#key-2",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "53l5yME2Ut_Fx_S3wpCfN2lVCPaWOXheNxH4GZpj8Is", "y": "YIQijcuvassCjvvio3d7EuiRcGHYdMbZtFjf2huszck" }
    }
  ],
  "assertionMethod": ["did:web:orbis.id#key-1", "did:web:orbis.id#key-2"]
}

A key you never have to handle

Signing happens inside a cloud vault under managed identity. The private key never touches disk, never appears in a config file, and never arrives in an email. There is no field anywhere in our onboarding that accepts a secret, a token, a password or a key — because there should not be one.

Take it back, publicly and privately at the same time

A revoked credential stops checking out everywhere, immediately, with nobody to notify. The status list is signed, compressed, and read whole — so you never learn which of your credentials somebody was asking about.

The whole list is one small signed file, and the reason it is read whole is the reason it protects the person: a verifier that fetches the entire list has told you nothing about which row it cared about.

The extra fields are not in the message

Your member proves membership in good standing to a counterparty without disclosing their member number. You do not have to trust the counterparty to discard the extra fields, because the extra fields are not in the message.

From your record to proof anyone can check

1. 01

   Set the organization up

   Its own verified name on the internet, a signing key it never has to handle, its brand on everything it hands out. Minutes, not quarters.

2. 02

   Hand out proof

   The person scans a code and it lands in their wallet, built so that later they can share one fact from it without revealing the rest.

3. 03

   Hold and control

   It lives on their phone, tied to that device. They decide what to show, and to whom, every single time.

4. 04

   Check it anywhere

   Anyone can check four things: the signature is real, the organization behind it is trusted, this is the right holder, and it has not been withdrawn.

Each step is only possible after the one before it, which is why they are numbered. The same four steps, in detail.

Your exit, stated before you sign anything

If you leave, you host one document somewhere else and every credential you ever issued keeps verifying — because verification reads your domain and never ours. Leaving costs one DNS record.

We think that is the only honest way to sell infrastructure: make leaving cheap, and then earn the renewal every year. It is also why we are comfortable publishing everything we have not built on the same website.

What it costs

Checking a proof

Free. Forever. Structurally.

There is no authenticated seam on the verification path to meter. The price and the privacy property come from the same fact.

Issuing

Metered on production credentials. Test issuance is unlimited and free.

The price is NOT SET. We are pre-revenue and we would rather leave this blank than print a number nobody is on the hook for.

The wallet

Free to the person.

There is no plan under which a person pays to hold or show a proof.

The full pricing page, including what is not priced yet and why.

Everything above, as things you can fetch

Three endpoints carry the whole argument. None of them takes a key, so you can check all three from a terminal right now and never speak to us.

• 200 · what this issuer can issue

  curl -s https://id.orbis.id/.well-known/openid-credential-issuer | jq .

• 200 · the keys the signature is checked against

  curl -s https://id.orbis.id/.well-known/did.json | jq .

• 200 · application/statuslist+jwt

  curl -s -D- -o /dev/null https://id.orbis.id/status/1 | grep -i content-type

Each of the three answered on 2026-08-27. If one of them does not answer for you, that is our problem and not yours — and you now have the URL to prove it.

What you would actually be joining today.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

curl -s https://id.orbis.id/.well-known/openid-credential-issuer | jq .

Straight answers

What does it conform to?

OpenID4VCI, OpenID4VP, SD-JWT VC, W3C Verifiable Credentials, DID Core with did:web, and the IETF Token Status List. Each of those carries its own state, and the page that holds one row per standard is here. The HAIP conformance suite has not been run. An eIDAS conformity assessment has not been sought.

Where is my data?

Facts stay in your systems. We mint and revoke signed statements about them. Held statements and consent live only on the person's device. There is no copy of your member table here, because we never asked for one.

Who is accountable if this breaks?

Named people, on the company page. There is no SLA today, and we will not blur alerting into one.

Can I start this afternoon without talking to anyone?

No. Self-service sign-up is not built. You can check every endpoint on this page without talking to anyone, and you can read the whole contract without an account — but the first two steps of getting your own name signing are still a person on our side of it.

What is not built?

Self-service sign-up, account recovery, the native wallet, issuer and wallet SDKs, and multi-format issuance — we issue SD-JWT VC only. The rows above say so, and the register will say so in more detail.