Shared Signals Framework

OpenID Shared Signals Framework - Real-time security event sharing with CAEP and RISC

Start with Recommended FlowRecommended Flow Open SSF Sandbox

Available Flows

Stream Configuration

Configure an SSF stream between a Transmitter (IdP) and Receiver (RP). Defines event types, delivery methods, and subject formats.

View flow diagram

Push Delivery

Real-time event delivery where the Transmitter POSTs Security Event Tokens (SETs) directly to the Receiver's endpoint (RFC 8935)

View flow diagram

Poll Delivery

Receiver-initiated event retrieval where the Receiver periodically polls the Transmitter for pending events (RFC 8936)

View flow diagram

Session Revoked (CAEP)

Continuous Access Evaluation Profile event indicating a user session has been terminated (CAEP §3.1). Receiving systems must immediately invalidate the affected session.

View flow diagram

Credential Change (CAEP)

Event indicating a user's credentials have changed (CAEP §3.2). Receiving systems should force re-authentication.

View flow diagram

Account Disabled (RISC)

Risk Incident Sharing event indicating a user account has been disabled (RISC §2.2). Receiving systems must immediately block access.

View flow diagram

Credential Compromise (RISC)

Security event indicating a user's credentials may have been compromised (RISC §2.1). Requires immediate protective action by all Receivers.

View flow diagram

Specs & references

Authoritative reading list for Shared Signals Framework — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.

Shared Signals Framework Features

Security Event Tokens (SET)

RFC 8417 signed JWTs for security events

CAEP Events

Continuous Access Evaluation Profile events

RISC Events

Risk Incident Sharing and Coordination events