Eclipse Biscuit

Identity Protocol

An authorization token with decentralized verification, offline attenuation and policy enforcement based on a logic language (Datalog). A Biscuit is signed with public-key cryptography so any service that knows the public key can verify it, and the holder can derive a new token with fewer rights, for instance a read-only or time-limited one, without contacting the issuer. Authorization policies are written in Datalog and can be supplied by the verifying application or carried by the token. Every token has unique revocation identifiers that reject it and all tokens attenuated from it. It suits capability-based authorization but can also express access control lists. Implementations exist in Rust, Haskell, Go, Java, JavaScript and WebAssembly, C, Python and C#; it is an Eclipse Foundation project .

Foundation
Links
Visit Website See this tool in the graph Suggest an edit

Details

License Permissive (Apache-2.0). https://github.com/eclipse-biscuit/biscuit (specification); implementations: biscuit-rust, biscuit-wasm, biscuit-python, biscuit-haskell, biscuit-java and others
Dev Status 🟢 Active
Owner Eclipse Foundation (project Eclipse Biscuit); maintained and led by Geoffroy Couprie, Clément Delafargue and Cédric Corbière, with dozens of contributors over the years
Governing Body Eclipse Foundation (Eclipse Biscuit project, status Incubating); project leads Geoffroy Couprie, Clément Delafargue and Cédric Corbière
Country Not stated by the project.
Start Year 2019
Stack Protobuf-serialized tokens, Ed25519 signatures, Datalog-based authorization language; Rust reference implementation compiled to WebAssembly for JavaScript; other language libraries
Funding Not stated by the project.
Last Investigated Oct 29, 2026

Use Case Domains

Identity & Trust

Affordances

Portable attestations Contextual disclosure

Identity Protocol Attributes

Origins An authorization token that blends public-key-verifiable tokens (as in JWT or macaroons) with offline attenuation and a logic-based policy language, so that services can verify and narrow permissions without a central authorization server
Database N/A
Query Language Datalog-based policy language for authorization rules, checks and facts
Data Formats Protobuf-encoded token with signed blocks; Ed25519 signatures; a base64 text form for transport
Mobile Support Library-level: Rust, WebAssembly and other language libraries; no application
Web Support Yes: online tooling lets tokens be created, attenuated, inspected and tested in a browser
Native Apps Library-level only
Terms Free and open source (Apache-2.0)
Funds Not stated by the project.
Based On Public-key tokens and capability security (JWT-style signatures, macaroon-style attenuation) with Datalog as the policy language
Permissions Capabilities and access control lists expressed as Datalog policies; attenuation can only add restrictions
Authentication & Identity Tokens are authorization credentials signed by the issuer's key; the token's blocks can carry facts about the holder, but identity itself is left to the application
Storage Model Tokens are self-contained and carried by the holder; verifiers need only the issuer's public key
Interoperability A protobuf schema and a published list of test cases let new implementations be built; implementations in nine languages are listed, with differing support for newer specification versions shown in the feature table
Data Portability Tokens can be passed between parties and attenuated offline; they are not tied to a particular service beyond the issuer's public key
Governance & Decision Making Eclipse Foundation project process with three named project leads; specification changes are made in the open repository and tracked in a roadmap issue
Protocol Maturity / Standardization Specification v3.3 and a stable earlier version; an Eclipse Foundation project in Incubating status; not an IETF or W3C deliverable; the project says it is still seeking an audit
Identity Standards No W3C DID or Verifiable Credentials mapping; the token is its own format
DID Methods Supported N/A
Key Management Ed25519 root key held by the issuer; attenuation blocks are signed with ephemeral keys derived along the chain
Credential Types Authorization tokens with attenuation blocks; not identity credentials
Verification Method Any verifier with the root public key checks the signature chain and then runs the Datalog policies against the token's facts and the request
Privacy Features Limited: the token carries its facts and checks in the clear, and the authors note attenuation is visible to the verifier; the project does not claim anonymity or unlinkability
Authentication Methods Public-key signatures on token blocks, with optional third-party blocks signed by other parties
Revocation Mechanism Unique revocation identifiers per block let a verifier reject a token and all tokens attenuated from it; expiry can be set by attenuation
Agent Types Supported Services, users and applications that issue, hold or verify tokens
Wallet/Client Types Libraries and online tooling; no wallet
Recovery Mechanisms Not stated by the project.
Compliance / Regulations Not stated by the project.
Credential Exchange Protocols None defined: tokens are carried in headers or messages by the application
Trust Framework Trust in the issuer's public key; third-party blocks allow trust in other parties' signatures when the verifier chooses
Cost Model Free to use
Censorship Resistance High for verification, since a verifier needs only a public key; issuance depends on the application