Decentralized Identifiers (DID)

Resolve W3C Decentralized Identifiers (DID Core 1.0, a W3C Recommendation) to verification keys — the missing link that lets a credential's issuer be named by a DID rather than a raw key. Resolve the issuer DID of a b.vc / b.mdoc / b.scitt credential to a node:crypto KeyObject, then hand that key to the verifier.

Three methods are supported. did:key encodes a public key directly in the identifier (multicodec + base58btc multibase) and did:jwk encodes it as a base64url public JWK — both resolve deterministically and offline (Ed25519, P-256, P-384, and secp256k1 round-trip). did:web places the DID document at an HTTPS URL derived from the identifier; the network fetch is the operator's to make (the same operator-supplied-input stance as the rest of the framework), and resolve takes the fetched document and extracts its verification methods.

b.did.keyToDid(publicKey) produces a did:key from a KeyObject (an issuer naming itself); b.did.parse(did) splits the identifier (and, for did:web, returns the HTTPS URL to fetch); b.did.resolve(did, opts) returns the DID document and its verification methods as KeyObjects. Verification methods expressed as publicKeyMultibase or publicKeyJwk are both understood.

Maturity. DID Core 1.0 is a Recommendation, but the method specs are deployed-stable rather than Recommendations: did:key is a W3C CCG report and did:web is a registered DID method (mandated by the EU Digital Identity Wallet). They are widely deployed and interoperable today; pin the dependency deliberately.

b.did.parse(did) #

Split a DID string into its method and method-specific id. For did:web the HTTPS URL of the DID document is also returned (host[:port][:path] → https://host/path/did.json, or /.well-known/did.json with no path).

b.did.parse("did:web:example.com:issuers:42");
// → { method: "web", id: "example.com:issuers:42", url: "https://example.com/issuers/42/did.json" }

b.did.keyToDid(publicKey, opts?) #

{
  {
    method: string,   // "key" (default) | "jwk"
  }
}

Encode a public key (a node:crypto KeyObject or PEM) as a DID — the inverse of resolution, for an issuer that names itself by its key. Defaults to did:key (multicodec + base58btc); pass opts.method = "jwk" for did:jwk (base64url-encoded public JWK). Ed25519, P-256, P-384, and secp256k1 are supported.

var did = b.did.keyToDid(issuerPublicKey);                 // → "did:key:z6Mk…"
var dj  = b.did.keyToDid(issuerPublicKey, { method: "jwk" }); // → "did:jwk:eyJr…"

b.did.resolve(did, opts?) #

{
  {
    document: object,   // did:web — the fetched did.json (required for did:web)
  }
}

Resolve a DID to its document and verification methods (each with a node:crypto public KeyObject ready for a verifier). did:key and did:jwk resolve deterministically and offline. did:web requires the operator to supply the fetched DID document as opts.document (the network fetch is the operator's; the URL to fetch is on b.did.parse(did).url).

var r = b.did.resolve("did:key:z6Mk…");
var key = r.verificationMethods[0].publicKey;   // → KeyObject for b.vc.verify / b.mdoc / b.scitt

Last updated 2026-08-08T16:39:49.652Z by seeder.