Add the Digital ID
to your service.
Embed a card on a profile or roster. Your service remains responsible for sign-in and access permissions.
Preview the embed.
This iframe renders and verifies the fictional demo credential. It does not receive tokens, issue credentials, or authenticate a player.
<iframe src="https://www.sigilid.space/card/" title="Sigil digital ID demo" style="width:100%;max-width:600px;height:880px;border:0" sandbox="allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox" ></iframe>
This demo is publicly accessible. Embedding remains subject to the host service’s framing and browser policies. The preview above runs within this Site.
Digital ID baseline · v1
The specimen implements this proposed display contract. Displayed dates use the Sigil universe calendar: UTC calendar year + 930. Cryptographic timestamps remain unchanged Unix timestamps.
| Field | Source and behavior |
|---|---|
| Name, username, RSI handle | Signed specimen claims; the sample handle is not a verified RSI account. |
| Card reference and schema version | Signed stable reference and explicit schema version 1. |
| Issued, not-before, expiry | Signed UTC timestamps, rechecked during inspection and while the page is active. |
| Portrait, stellar edition, light angle | Presentation only. The portrait is fictional artwork; the edition conveys no location, affiliation, or authority. |
| Trust state | Pending, demo signature verified, or verification unavailable. Current account control and revocation remain separately unestablished. |
The production contract.
These are proposed implementation requirements, not existing Sigil Digital ID endpoints.
- Authenticate with Sigil. The service validates its OIDC response, including issuer, intended audience, expiry, and the login transaction. Match the authenticated subject to the credential.
- Issue a minimal credential. Sigil’s server signs only the approved display claims. Keep email, Discord, and organization membership private by default. Use service-specific identifiers when correlation is unnecessary.
- Verify before display. Trust configured Sigil signing keys, never a key supplied by a card. Check signature, issuer, intended service, validity, and live credential status.
- Establish current control when needed. Use a fresh, audience-bound, single-use challenge or recent Sigil authentication. A reusable signed card or screenshot is not proof of possession.
- Render through an optional component. Supply a scoped presentation reference to the trusted card host. Never put access tokens, ID tokens, or full private claims in an iframe URL.
- Fail closed. Expired, revoked, untrusted, or unavailable checks must not appear as verified. Organization roles and service permissions remain separate from identity.
Verification requirements.
| Check | This prototype | Production requirement |
|---|---|---|
| Signature integrity | Working cryptographic check | Sigil-managed signing keys and rotation |
| Issuer & audience | Fixed demo values | Trusted issuer and intended service |
| Expiry | Browser-clock check | Trusted service-side time validation |
| Revocation | Unavailable | Fresh issuer status, with fail-closed policy |
| Current holder | Not checked | Authenticated subject binding or challenge response |
| Authorization | No access granted | Independent service permission checks |
The demo uses a custom signed envelope; it is not a claim of W3C Verifiable Credential conformance. Design references: OpenID Connect Core ↗ and W3C credential model ↗.
Download signed demo record ↓