[OPINION] Digital Credentials API: Balancing Usability and Privacy

As part of the EUDI Wallet Architecture and Reference Framework (ARF), the Digital Credentials API discussion paper (F - Digital Credentials API) explores how to integrate the European Digital Identity Wallet with web browsers and mobile applications.

The ARF, currently at version 1.8.0, is still evolving, and these discussions contribute to ongoing refinements within the European Digital Identity Cooperation Group.

The following is Gataca's opinion on the Digital Credentials API topic.

Digital Credentials API Overview

The Digital Credentials API discussion paper explores how to integrate the EUDI Wallet with web browsers and mobile applications. This integration is crucial for enabling secure and seamless attestation presentations in remote transactions but the paper outlines several challenges:

• Secure Cross-Device Flows: Ensuring secure communication between devices when the wallet and the relying party are on separate devices.
• Wallet Unit Selection and Invocation: Facilitating user-friendly methods for selecting and activating the appropriate wallet instance.
• Fragmented Interaction Mechanisms: Addressing inconsistencies in user interactions across different platforms and devices.
• Clear Origin Verification: Accurately identifying the origin of relying party instances to prevent relay attacks.
• Session Binding: Maintaining context integrity during user interactions to prevent session hijacking.

To address these challenges, the paper proposes adopting the Digital Credentials API, which extends the Credential Management Level 1 API W3C Working Draft.

This API would allow user agents, such as browsers, to mediate credential access and attestation presentations.

This can occur in two ways: the browser and the Wallet Unit may be in the same device (same-device flow) or in separate devices but in proximity (cross-device flow).

Here’s how it works in practice:

1. Credential Storage & Management – Users store their digital credentials in their EUDI Wallet (a secure app, browser extension, or trusted application). The browser acts as a bridge between the wallet and web applications.
2. Requesting Credentials – When a website (Relying Party) requests authentication, the browser forwards the request to the EUDI Wallet. The wallet verifies legitimacy, and the user approves or denies the request before any data is shared.

3. Presenting Credentials – If approved, the wallet generates a verifiable attestation, and the browser ensures only necessary information is shared with the Relying Party.

A Step Toward Usability

The Digital Credentials API aims to simplify interactions between users (Holders), service providers (Relying Parties), and credential issuers.

At first glance, this effort is a step in the right direction. Simplifying API interactions in browser environments will significantly improve user experience, making authentication and data sharing more seamless and intuitive.

In this context, at Gataca, we fully support the push to enhance accessibility and usability, which will undoubtedly lead to broader adoption and a better digital experience for European citizens.

The Privacy Concern

However, there is a critical issue that cannot be ignored: privacy.

The proposed model introduces an intermediary component in all communications between the Holder Wallet and the Relying Party. This creates a significant surveillance risk—an intermediary that can observe, extract, and even track user interactions.

This means the intermediary could observe when and where users authenticate themselves, track which services users interact with and see what type of credential is being presented, which over time, this data could be compiled to build a detailed profile of users' habits and preferences.

This is not a new problem. We’ve seen this in previous identity systems such as federated identity systems, where intermediaries became central points of control and continue to track users across the web. If privacy is a core principle of the EUDI Wallet, this model fundamentally contradicts that objective.

The Need for a Privacy-First Approach

While usability is crucial, it should not come at the cost of privacy. For the EUDI Wallet to uphold privacy principles, a truly privacy-preserving architecture should:

• Ensure that user interactions remain as direct and confidential as possible, eliminating unnecessary intermediaries or, at the very least,
• Ensure intermediaries cannot access or track transaction metadata (who, what, when, where).

This means adopting a decentralized model or, at a minimum, implementing strong cryptographic protections to protect user data.

Additionally, beyond privacy another long-term structural concern looms: the risk of vendor lock-in. Since browsers are controlled by Big Tech companies and will inevitably drive usability improvements, this approach is likely to become a de facto standard.

If this trajectory is left unchecked, there is a significant risk of vendor lock-in by Big Techs in the European digital identity ecosystem, threatening digital sovereignty and limiting innovation from independent or open-source providers.

In conclusion, it is important to note that at the moment the API is not mandatory and remains under development. Therefore, these discussions are key to address these concerns before widespread adoption locks us into a model that undermines the very values the EUDI Wallet aims to uphold.