Affinidi Vault

Identity that liveswith the user

Affinidi Vault stores DIDs and Verifiable Credentials on the user's device so your app can request trusted claims without holding private keys or personal data.

Book a demo View Documentation

Where it fits

The holder layer of the Affinidi Trust Network

Affinidi Vault sits at the holder layer of the Affinidi Trust Network, the layer where identity lives closest to the person it belongs to.

Every Affinidi product that involves a user, Affinidi Login, credential issuance, and verification flows, depends on a Vault being present. The Vault is where the user's end of the trust chain lives.

Impact

Vault anchors the user side of your trust chain so login, issuance, and verification flows can run with cryptographic assurance and lower data risk.

Without the Vault

Credentials have nowhere secure to land. Verification has nothing to check against. The user has no control.

With the Vault

Your application can request verified claims, receive signed presentations, and trust responses without managing personal data itself.

No private keys in your backend

Identity stays with the user while your application verifies only what it needs for each flow.

Core capabilities

What Affinidi Vault gives you

Four core capabilities for user-controlled identity infrastructure.

Affinidi Vault

User-controlled credential storage

Digital wallet enabling users to securely collect, store, and share verifiable credentials with granular consent controls using OID4VCI and OID4VP protocols.

Explore More

Affinidi SSI

Decentralised identity implementation toolkit

Comprehensive libraries and tools for building decentralised identity capabilities across platforms.

Explore More

DCQL

Digital credentials query language

A standardised query interface that enables verifiers to request specific credentials from user wallets, supporting credential sharing and selective disclosure.

Explore More

Affinidi TDK - Vault

Provides libraries and tools for embedding Affinidi Vault into your existing Dart applications, implementing Self-Sovereign Identity (SSI) for decentralised identity management.

Explore More

How it works

How Vault stores, organises, and proves identity data

The Vault follows a straightforward flow whether you are using the app or the SDK.

Identity container

One per userSecured by passphrase + biometrics

Holds

Profile A Profile (DID + credentials)

Profile B Profile (DID + credentials)

Profile C Profile (DID + credentials)

* Stored in device local storage or user's cloud

01 Auth

Affinidi Login authenticates the user

The Vault provides the DID to prove identity without exposing credentials.

02 Issuance

Issuer sends VC via OID4VCI flow

The credential is received and stored encrypted inside the matching profile.

03 Verification

Verifier requests a Verifiable Presentation

The Vault signs the VP locally using the profile's private key before sharing.

Setup

User creates a Vault secured by passphrase. A root identity is established.

Profile creation

User creates one or more profiles. Each profile mints a unique DID.

Credential claim

User receives a VC from an issuer (OID4VCI). Vault stores it encrypted in the matching profile.

Presentation

User selects credentials to share. Vault signs a Verifiable Presentation with the profile's private key.

Verification

Verifier receives the VP, checks the signature against the issuer's DID, and trusts the result.

How teams use it

One Vault, different value for every team

Whether you run login, issuance, verification, or wallet UX, the same Vault gives each team a clearer boundary and a simpler trust model.

In practice

Keep identity with users while every team gets verifiable outcomes

Product teams use Vault to authenticate users and request only the claims they need at each moment. Security teams get cryptographic proof without centralising private keys. Compliance teams reduce data exposure because credentials remain with the holder, not your backend.

The result is one holder layer that supports passwordless login, credential issuance, and verification journeys without duplicating identity storage models across business units.

Less PII in your systems
Reusable identity across flows
Cryptographic trust at each step
Cleaner team boundaries

Authentication, issuance, and verification teams

Use one holder layer across the credential lifecycle so each team plugs into the same user-controlled identity source.

Login flows get verified, consent-driven claims without password stores
Issuance flows deliver credentials directly into user profiles via OID4VCI
Verification flows request signed presentations without handling raw credentials

Platform and enterprise teams

Run Vault as a ready app or embed it in your own UX with profile-level separation for complex organisations.

Embed wallet capabilities with Flutter/Dart SDK in your branded experience
Separate personal, work, and project identities with multi-profile structure
Support internal identity and access models without merging credential contexts

For developers

Two ways to ship with Affinidi Vault

Affinidi Vault ships in two forms. Both give your team full control.

Use the web and mobile app

For teams who need users to have a Vault today, without building one. Available as a web app and Android mobile app.

Read Vault docs

Build with the Vault SDK

For teams embedding wallet capabilities directly into their own Flutter applications with DID/profile management and credential flows inside their product.

See how Vault works

Explore the suite

Part of Affinidi Elements

Affinidi Vault is one part of the Affinidi Elements suite. Combine it with Elements Services and Messaging to complete the loop from issuance to ownership to secure sharing.

Issue, verify, request and manage Verifiable Credentials

The credential layer for your apps and workflows
Credential Issuance, Login, Verification and Iota
Everything you need to build a production credential ecosystem

See product page

Encrypted, verifiable communication for people, businesses, and AI agents

Built on DIDComm v2.1, open, decentralised, interoperable
End-to-end encrypted, mediators route but cannot read messages
Exchange verifiable credentials securely between any parties

See product page

Get started

Ready to ship user-controlled identity?

Deploy Vault for users now or embed it directly into your own app experience.

Talk to our team

Talk to our team about how Affinidi Vault fits your login, issuance, and verification architecture.

Book a demo

Start building now

See implementation details, flow breakdowns, and integration guidance for Affinidi Vault.

View Documentation

Identity that liveswith the user

The holder layer of the Affinidi Trust Network

Without the Vault

With the Vault

No private keys in your backend

What Affinidi Vault gives you

Affinidi Vault

Affinidi SSI

DCQL

Affinidi TDK - Vault

How Vault stores, organises, and proves identity data

Affinidi Login authenticates the user

Issuer sends VC via OID4VCI flow

Verifier requests a Verifiable Presentation

Setup

Profile creation

Credential claim

Presentation

Verification

One Vault, different value for every team

Keep identity with users while every team gets verifiable outcomes

Authentication, issuance, and verification teams

Platform and enterprise teams

Two ways to ship with Affinidi Vault

Use the web and mobile app

Build with the Vault SDK

Part of Affinidi Elements

Ready to ship user-controlled identity?

Talk to our team

Start building now

Explore the ecosystem

Affinidi Trust Fabric

Affinidi Radix

Affinidi Elements

Affinidi Forge