UCAN

Protocolo de Identidade

User Controlled Authorization Network: a specification for authorization that is public-key verifiable, delegable and openly extensible, with no central authority needed to check a permission. A UCAN is a signed token in which one party, identified by a decentralized identifier (DID), grants a capability over a resource to another and may allow that party to pass it on in narrower form; a chain of such tokens is the proof that a request is authorised, and anyone can verify the chain offline. The specification is split into sub-specifications for delegation, invocation, promise and revocation. It was designed for local-first and peer-to-peer settings and positions itself as a successor to access control lists and as an authorization layer for applications and AI agents .

Comunidade
Links
Visitar Website Ver esta ferramenta no grafo Sugerir uma correção

Detalhes

Licença Specification text under the Community Specification License 1.0; any source code or reference code in the repository is under the MIT licence . https://github.com/ucan-wg/spec
Status de Dev 🟢 Ativo
Proprietário A community working group around the ucan-wg organisation; the specification's editor is Brooklyn Zelenka (Witchcraft Software) and its listed authors are from Protocol Labs, Bluesky, number zero and Witchcraft Software
Proprietário - Lista
  • Protocol Labs
Órgão de Governança UCAN Working Group (ucan-wg) with a governance document in the repository; the cited sources do not describe how decisions are made beyond that
País Not stated by the project.
Ano de Início 2021
Stack DAG-CBOR-encoded signed tokens, DIDs for principals, public-key signatures; sub-specifications for delegation, invocation, promise and revocation
Financiamento Not stated by the project.
Última Investigação 29 de out. de 2026

Visão de topologia

Esta ferramenta no centro e o que se relaciona diretamente com ela. Cada linha nomeia o tipo de relação.

Visão de topologia: UCANEsta ferramenta no centro e o que se relaciona diretamente com ela. Cada linha nomeia o tipo de relação.UCANKeyhive (Base de, Implementações em conformidade, Inspirou)KeyhiveDIDs (Está em conformidade com, Fala o protocolo)DIDsProtocol Labs (Desenvolvido por)ProtocolLabsArweave (Interopera com)ArweaveIPFS (Interopera com)IPFS
  • Keyhive (Ferramenta): Base de, Implementações em conformidade, Inspirou
  • DIDs (Ferramenta): Está em conformidade com, Fala o protocolo
  • Protocol Labs (Organização): Desenvolvido por
  • Arweave (Ferramenta): Interopera com
  • IPFS (Ferramenta): Interopera com

Abrir no Explorador de grafo

Domínios de Caso de Uso

Identidade e Confiança

Capacidades

Identidade soberana Atestações portáteis

Protocolo de Identidade Atributos

Proprietário - Lista
  • Protocol Labs
Origens Authorization for local-first and peer-to-peer systems: replace access control lists on a central server with user-originated, delegable capabilities that can be verified offline, building on the SPKI/SDSI and object-capability traditions
Banco de Dados N/A
Linguagem de Consulta N/A
Formatos de Dados UCAN tokens encoded with DAG-CBOR; principals as DIDs; the delegation, invocation, promise and revocation formats are given in the sub-specifications
Suporte Móvel Library-level: the project lists libraries; the specification itself is platform-independent
Suporte Web Yes: a project website with a UCAN inspector, and JavaScript libraries listed by the project
Aplicativos Nativos Library-level only; UCAN is a token format, not an application
Termos Free and open: the specification is published under the Community Specification License 1.0, with sample code under MIT
Fundos Not stated by the project.
Baseado Em SPKI/SDSI certificates and object-capability security; DIDs and DAG-CBOR; the specification cites the lineage of capability systems
Permissões The model is the permission model: capabilities are delegated downward and can only be narrowed, never widened (attenuation)
Autenticação e Identidade Principals are identified by DIDs and prove control by signing; authorization is carried as a chain of delegations to the subject DID rather than a login
Modelo de Armazenamento Tokens are self-contained and carried by the parties; no registry or ledger is required for verification
Interoperabilidade Designed to work across DID methods and with content-addressed storage and web APIs; the site names IPFS, Arweave and API access as use cases
Portabilidade de Dados Authority is portable: a chain of delegations can be presented to any verifier that understands the format, independent of the service that issued the first token
Governança e Tomada de Decisão Working-group process documented in the repository's governance file and scope document; changes are made through issues and pull requests
Maturidade / Padronização do Protocolo Specification version 1.0.0 in the README with a v1.0 release candidate tagged; Community Specification License; not a standards-body deliverable
Padrões de Identidade DIDs (W3C); DAG-CBOR and content identifiers; a UCAN is not itself a W3C or IETF standard
Padrões de Identidade - Lista
Métodos DID Suportados Any DID method that can resolve a verification key; the specification does not mandate one
Gestão de Chaves Each principal holds its own signing key; delegation is by signature, so key custody is left to the application or wallet
Tipos de Credenciais Capabilities (delegations and invocations) rather than identity credentials
Tipos de Credenciais - Lista
Método de Verificação A validator checks the signatures, time bounds and attenuation along the whole delegation chain, offline, without contacting the issuer
Recursos de Privacidade Limited by design: a token reveals the issuer, audience and capability granted; the specification does not describe zero-knowledge or selective disclosure
Métodos de Autenticação Public-key signatures by the issuing principal over the token
Mecanismo de Revogação A separate revocation sub-specification; tokens can also carry expiry times and the site mentions blacklisting support
Tipos de Agentes Suportados Any agent with a DID, including people, organisations, services and, the site says, AI agents
Tipos de Carteira/Cliente Libraries and applications that hold keys; no dedicated wallet is described in the cited sources
Mecanismos de Recuperação Not stated by the project.
Conformidade / Regulamentações Not stated by the project.
Protocolos de Troca de Credenciais Invocation and delegation are defined by the specification; transport (HTTP, peer-to-peer, other) is left to the application
Protocolos de Troca de Credenciais - Lista
Estrutura de Confiança Cryptographic proof chains rooted at the resource's owner, with no central registry; the verifier decides which roots to trust
Modelo de Custo Free to use
Resistência à Censura High for verification, since no central party is consulted; issuance and storage depend on the application

Relacionamentos

Como esta ferramenta se conecta a outras ferramentas e organizações, a partir de relacionamentos revisados pelo responsável pelos dados do OpenHaven. Descrevem como os projetos se conectam, não a qualidade deles.

Desenvolvido por
  • Protocol Labs
Está em conformidade com
Fala o protocolo
Interopera com
Base de
Implementações em conformidade
Inspirou