did:web
A decentralized identifier method that anchors an identity to a domain name, resolving to a DID document hosted over HTTPS at a well-known path.
did:web is a way of writing a decentralized identifier that ties it to a domain name. An identifier like did:web:mailgent.dev:agents:bright-otter resolves to a DID document served over HTTPS, which lists the public keys and services for that identity.
It's popular because it needs no blockchain and no special infrastructure — just a domain and an HTTPS endpoint — while still giving an agent a globally resolvable, verifiable identity.
How resolution works
To resolve a did:web identifier, you transform it into an HTTPS URL and fetch the DID document. The document publishes the agent's public keys, so anyone can verify a signature the agent produced.
Because it's served from a domain the operator controls, trust in the identity is rooted in trust in that domain — the same model the web already uses for TLS.
did:web:mailgent.dev:agents:bright-otter
-> https://mailgent.dev/agents/bright-otter/did.json
{ "id": "did:web:mailgent.dev:agents:bright-otter",
"verificationMethod": [{ "type": "Ed25519VerificationKey2020", ... }] }Why agents use it
did:web gives an agent a stable, human-readable identity that resolves anywhere, without the cost or complexity of an on-chain DID. Combined with an Ed25519 key, the agent can sign requests that any party can verify.
FAQ
Does did:web need a blockchain?
No. It resolves over plain HTTPS from a domain, which is what makes it simple to adopt.
Where is the DID document hosted?
At a well-known HTTPS path derived from the identifier, on the domain the identity is anchored to.
Give your agent an inbox.
A real email address, a vault, 2FA, and an identity in one API call.