Identity Deep Dive

WIMSE Workload Proof Token

A per-request signed JWT that proves possession of the key in a Workload Identity Token, bound to the target and message.

Where it stands
Working-group draft
Official text
draft-ietf-wimse-wpt-02
2026-08-27
Documented support
0
Activity
2 signals in 90 days

No explainer written for this spec yet. The summary, relations and documented support below are maintained.

A per-request signed JWT that proves possession of the key in a Workload Identity Token, bound to the target and message.

How it relates to other specs

Relations diagram
flowchart LR
  s_wpt["WIMSE Workload Proof Token"]
  s_wimse_creds["WIMSE Workload Credentials"]
  s_dpop["DPoP"]
  s_wimse_httpsig["WIMSE HTTP Message Signatures"]
  style s_wpt stroke-width:3px
  s_wpt -->|Builds on| s_wimse_creds
  s_wpt -.-|Alternative to| s_dpop
  s_wimse_httpsig -.-|Alternative to| s_wpt

Documented support

Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.

No sourced support entries collected yet. This says nothing about how widely it is used.

Activity

Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.

Explanations on this site

  • DiscussionIETF WIMSE

    Kathleen's review of draft-ietf-wimse-wpt asks why jti replay checking is only RECOMMENDED and what collision-resistant claim names means.

    Review of draft-ietf-wimse-wpt

    Read the explanation

    The review is mostly editorial and reads the draft as a clear guide for implementers. It asks to break out the Key Characteristics paragraphs. From a security view it asks why the check that a jti has not been used before in the WPT validity window is RECOMMENDED rather than MUST. It also asks what collision resistant means for a claim such as example.com/myclaim, since the term usually refers to hash functions. No text change has been made.

    • An implementer deciding whether to enforce jti replay detection on WPTs when the draft only recommends it.

On the mailing list