UCAN

Protocolo de Identidad

User Controlled Authorization Network: a specification for authorization that is public-key verifiable, delegable and openly extensible, with no central authority needed to check a permission. A UCAN is a signed token in which one party, identified by a decentralized identifier (DID), grants a capability over a resource to another and may allow that party to pass it on in narrower form; a chain of such tokens is the proof that a request is authorised, and anyone can verify the chain offline. The specification is split into sub-specifications for delegation, invocation, promise and revocation. It was designed for local-first and peer-to-peer settings and positions itself as a successor to access control lists and as an authorization layer for applications and AI agents .

Comunidad
Enlaces
Visitar Sitio Web Ver esta herramienta en el grafo Sugerir una corrección

Detalles

Licencia Specification text under the Community Specification License 1.0; any source code or reference code in the repository is under the MIT licence . https://github.com/ucan-wg/spec
Estado de Desarrollo 🟢 Activo
Propietario A community working group around the ucan-wg organisation; the specification's editor is Brooklyn Zelenka (Witchcraft Software) and its listed authors are from Protocol Labs, Bluesky, number zero and Witchcraft Software
Propietario - Lista
  • Protocol Labs
Órgano de Gobierno UCAN Working Group (ucan-wg) with a governance document in the repository; the cited sources do not describe how decisions are made beyond that
País Not stated by the project.
Año de Inicio 2021
Stack DAG-CBOR-encoded signed tokens, DIDs for principals, public-key signatures; sub-specifications for delegation, invocation, promise and revocation
Financiamiento Not stated by the project.
Última Investigación 29 oct 2026

Vista de topología

Esta herramienta en el centro y lo que se relaciona directamente con ella. Cada línea nombra el tipo de relación.

Vista de topología: UCANEsta herramienta en el centro y lo que se relaciona directamente con ella. Cada línea nombra el tipo de relación.UCANKeyhive (Base de, Implementaciones conformes, Inspiró a)KeyhiveDIDs (Cumple con, Habla el protocolo)DIDsProtocol Labs (Desarrollado por)ProtocolLabsArweave (Interopera con)ArweaveIPFS (Interopera con)IPFS
  • Keyhive (Herramienta): Base de, Implementaciones conformes, Inspiró a
  • DIDs (Herramienta): Cumple con, Habla el protocolo
  • Protocol Labs (Organización): Desarrollado por
  • Arweave (Herramienta): Interopera con
  • IPFS (Herramienta): Interopera con

Abrir en el Explorador de grafo

Dominios de Caso de Uso

Identidad y Confianza

Capacidades

Identidad soberana Atestaciones portátiles

Protocolo de Identidad Atributos

Propietario - Lista
  • Protocol Labs
Orígenes Authorization for local-first and peer-to-peer systems: replace access control lists on a central server with user-originated, delegable capabilities that can be verified offline, building on the SPKI/SDSI and object-capability traditions
Base de Datos N/A
Lenguaje de Consulta N/A
Formatos de Datos UCAN tokens encoded with DAG-CBOR; principals as DIDs; the delegation, invocation, promise and revocation formats are given in the sub-specifications
Soporte Móvil Library-level: the project lists libraries; the specification itself is platform-independent
Soporte Web Yes: a project website with a UCAN inspector, and JavaScript libraries listed by the project
Aplicaciones Nativas Library-level only; UCAN is a token format, not an application
Términos Free and open: the specification is published under the Community Specification License 1.0, with sample code under MIT
Fondos Not stated by the project.
Basado En SPKI/SDSI certificates and object-capability security; DIDs and DAG-CBOR; the specification cites the lineage of capability systems
Permisos The model is the permission model: capabilities are delegated downward and can only be narrowed, never widened (attenuation)
Autenticación e Identidad Principals are identified by DIDs and prove control by signing; authorization is carried as a chain of delegations to the subject DID rather than a login
Modelo de Almacenamiento Tokens are self-contained and carried by the parties; no registry or ledger is required for verification
Interoperabilidad Designed to work across DID methods and with content-addressed storage and web APIs; the site names IPFS, Arweave and API access as use cases
Portabilidad de Datos Authority is portable: a chain of delegations can be presented to any verifier that understands the format, independent of the service that issued the first token
Gobernanza y Toma de Decisiones Working-group process documented in the repository's governance file and scope document; changes are made through issues and pull requests
Madurez del Protocolo / Estandarización Specification version 1.0.0 in the README with a v1.0 release candidate tagged; Community Specification License; not a standards-body deliverable
Estándares de Identidad DIDs (W3C); DAG-CBOR and content identifiers; a UCAN is not itself a W3C or IETF standard
Estándares de Identidad - Lista
Métodos DID Soportados Any DID method that can resolve a verification key; the specification does not mandate one
Gestión de Claves Each principal holds its own signing key; delegation is by signature, so key custody is left to the application or wallet
Tipos de Credenciales Capabilities (delegations and invocations) rather than identity credentials
Tipos de Credenciales - Lista
Método de Verificación A validator checks the signatures, time bounds and attenuation along the whole delegation chain, offline, without contacting the issuer
Funciones de Privacidad Limited by design: a token reveals the issuer, audience and capability granted; the specification does not describe zero-knowledge or selective disclosure
Métodos de Autenticación Public-key signatures by the issuing principal over the token
Mecanismo de Revocación A separate revocation sub-specification; tokens can also carry expiry times and the site mentions blacklisting support
Tipos de Agentes Soportados Any agent with a DID, including people, organisations, services and, the site says, AI agents
Tipos de Billetera/Cliente Libraries and applications that hold keys; no dedicated wallet is described in the cited sources
Mecanismos de Recuperación Not stated by the project.
Cumplimiento / Regulaciones Not stated by the project.
Protocolos de Intercambio de Credenciales Invocation and delegation are defined by the specification; transport (HTTP, peer-to-peer, other) is left to the application
Protocolos de Intercambio de Credenciales - Lista
Marco de Confianza Cryptographic proof chains rooted at the resource's owner, with no central registry; the verifier decides which roots to trust
Modelo de Costos Free to use
Resistencia a la Censura High for verification, since no central party is consulted; issuance and storage depend on the application

Relaciones

Cómo se conecta esta herramienta con otras herramientas y organizaciones, según relaciones revisadas por el responsable de datos de OpenHaven. Describen cómo se conectan los proyectos, no su calidad.

Cumple con
Desarrollado por
  • Protocol Labs
Habla el protocolo
Interopera con
Base de
Implementaciones conformes
Inspiró a