SPIFFE

aid: spiffe
deliveryModel:
  model: self-hosted
  license: Apache-2.0
  open_source: true
  commercial: false
  callable_host: false
  label: Self-hosted open source · you run it yourself
  confidence: high
  source:
  - license
  - openapi
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: freemium
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Freemium
  confidence: medium
  source:
  - plans
  generated: '2026-07-22'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/spiffe.png
name: SPIFFE
description: Secure Production Identity Framework for Everyone (SPIFFE) is a set of open-source standards for securely identifying
  software systems in dynamic and heterogeneous environments through platform-agnostic, cryptographic identities. SPIFFE defines
  the SPIFFE ID URI format, the X.509 SVID and JWT SVID identity document formats, and the Workload API for issuing and rotating
  identities without secrets or passwords. SPIFFE is a graduated CNCF project.
url: https://spiffe.io/
tags:
- Authentication
- Cloud-Native
- Graduated
- Identity
- Security
- Zero Trust
tags_raw:
- Authentication
- Cloud Native
- Graduated
- Identity
- Security
- Zero Trust
created: '2025'
modified: '2026-05-19'
specificationVersion: '0.23'
type: Index
apis:
- aid: spiffe:spiffe-workload-api
  name: SPIFFE Workload API
  description: The SPIFFE Workload API is a gRPC streaming interface through which workloads request and receive SPIFFE Verifiable
    Identity Documents (SVIDs) including X.509-SVIDs and JWT-SVIDs, as well as trust bundle updates. It enables software to
    obtain cryptographic identities at runtime without requiring secrets to be embedded in configuration or code.
  humanURL: https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/
  - type: Reference
    url: https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
  - type: AsyncAPI
    url: asyncapi/spiffe-workload-asyncapi.yml
  - type: GitHubRepository
    url: https://github.com/spiffe/spiffe
  tags:
  - gRPC
  - Identity
  - JWT
  - Workload
  - X.509
- aid: spiffe:spiffe-x509-svid-api
  name: SPIFFE X.509 SVID
  description: The SPIFFE X.509 SVID (SPIFFE Verifiable Identity Document) is a standard for encoding SPIFFE identities into
    X.509 certificates. The Subject Alternative Name field carries the SPIFFE ID URI, enabling mutual TLS authentication between
    workloads using standard X.509 certificate validation libraries.
  humanURL: https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/spiffe-about/svid/
  - type: Reference
    url: https://github.com/spiffe/spiffe/blob/main/standards/X509-SVID.md
  - type: GitHubRepository
    url: https://github.com/spiffe/spiffe
  tags:
  - Certificate
  - Identity
  - mTLS
  - Security
  - X.509
- aid: spiffe:spiffe-jwt-svid-api
  name: SPIFFE JWT SVID
  description: The SPIFFE JWT SVID standard defines a format for encoding SPIFFE identities as JSON Web Tokens. JWT-SVIDs
    are used in scenarios where X.509 certificates are not practical, such as HTTP header-based authentication between services
    or for passing identity across trust domain boundaries.
  humanURL: https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/spiffe-about/svid/
  - type: Reference
    url: https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md
  - type: GitHubRepository
    url: https://github.com/spiffe/spiffe
  tags:
  - Authentication
  - Identity
  - JWT
  - Security
- aid: spiffe:spiffe-bundle-api
  name: SPIFFE Bundle API
  description: SPIFFE trust bundle retrieval operations for fetching root CA certificates used to validate SVIDs issued by
    a trust domain
  humanURL: https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md
  tags:
  - Bundle
  properties:
  - type: OpenAPI
    url: openapi/spiffe-bundle-api-openapi.yml
  - type: Documentation
    url: https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/
  - type: Reference
    url: https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md
  - type: GitHubRepository
    url: https://github.com/spiffe/spiffe
  - type: SpectralRules
    url: rules/spiffe-rules.yml
common:
- type: IssueTracker
  url: https://github.com/spiffe/spiffe/issues
- type: CodeOfConduct
  url: https://github.com/spiffe/spiffe/blob/main/CODE-OF-CONDUCT.md
- type: ContributionGuide
  url: https://github.com/spiffe/spiffe/blob/main/CONTRIBUTING.md
- type: License
  name: Apache-2.0
  url: https://github.com/spiffe/spiffe/blob/main/LICENSE
- type: AgenticAccess
  url: agentic-access/spiffe-agentic-access.yml
- type: DomainSecurity
  url: security/spiffe-domain-security.yml
- type: LinkedIn
  url: https://www.linkedin.com/company/spiffe-secure-production-identity-framework-for-everyone
- type: JSONSchema
  url: json-schema/spiffe-svid-schema.json
- type: JSONLD
  url: json-ld/spiffe-context.jsonld
- type: SpectralRules
  url: rules/spiffe-rules.yml
- type: Vocabulary
  url: vocabulary/spiffe-vocabulary.yml
- type: Website
  url: https://spiffe.io/
- type: Documentation
  url: https://spiffe.io/docs/latest/
- type: GettingStarted
  url: https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/
- type: GitHubOrganization
  url: https://github.com/spiffe
- type: GitHubRepository
  url: https://github.com/spiffe/spiffe
- type: Community
  url: https://spiffe.io/community/
- type: Slack
  url: https://slack.spiffe.io
- type: Blog
  url: https://spiffe.io/blog/
- type: Security
  url: https://github.com/spiffe/spiffe/blob/main/SECURITY.md
- type: StackOverflow
  url: https://stackoverflow.com/questions/tagged/spiffe
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com