====== Credential ======

[[dido:99_annexes:annex-b-terms-and-definitions:start|Go up to Terms and Definitions]]

===== Discussion =====

A Credential associates an [[dido:99_annexes:annex-b-terms-and-definitions:i:identity|Identity]] or authority claim with information used during [[dido:99_annexes:annex-b-terms-and-definitions:a:authentication|Authentication]] or [[dido:99_annexes:annex-b-terms-and-definitions:a:access_control|Access Control]].

Credentials include passwords, authentication tokens, cryptographic certificates, signed assertions, application credentials, service credentials, and physical or digital identity tokens.

A Credential contains [[dido:99_annexes:annex-b-terms-and-definitions:c:cryptographic_material|Cryptographic Material]], refers to Cryptographic Material, or operates without Cryptographic Material. The concepts overlap but remain distinct. A Credential supports an identity or authority claim. Cryptographic Material supports a cryptographic operation or relationship.

A Credential requires controlled creation, issuance, storage, distribution, use, rotation, revocation, retention, and disposal throughout its [[dido:99_annexes:annex-b-terms-and-definitions:l:lifecycle|Lifecycle]].

===== Definition =====

//representation of an identity or authority claim used in authentication or access control//

===== Source =====

DIDO Solutions project definition.

===== Note =====

Possession of a Credential does not independently establish authorisation. An authentication or access-control process evaluates the Credential and the applicable [[dido:99_annexes:annex-b-terms-and-definitions:p:policy|Policy]] before granting access.

A record identifies a sensitive Credential through a protected reference, identifier, digest, or redacted representation rather than an exposed value.

The controls applied to a Credential preserve its required [[dido:99_annexes:annex-b-terms-and-definitions:c:confidentiality|Confidentiality]], [[dido:99_annexes:annex-b-terms-and-definitions:i:integrity|Integrity]], authenticity, availability, and [[dido:99_annexes:annex-b-terms-and-definitions:t:traceability|Traceability]].

===== Example =====

A client certificate presented by a [[dido:99_annexes:annex-b-terms-and-definitions:n:node|Node]] during mutual TLS authentication constitutes a Credential.

----

<WRAP centeralign>
© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.
</WRAP>