DID Method Guide

Every creator, content item, and broadcast entity in OCME Registry is identified by a Decentralized Identifier (DID) using the did:webvh method — a W3C DID Core-compatible, HTTPS-resolvable identifier scheme.

Identifier Format

did:webvh:{domain}:{entityType}:{id}
  • domain — the registry host that resolves the identifier: prod.ocmeregistry.com in production, dev.ocmeregistry.com in development.
  • entityType — one of: creator, content, media, splitsheet, showrunner, member, cube.
  • id — the entity identifier (URL-encoded where needed): a creator id, content id, media id, splitsheet id, showrunner slug, or member hash.
Example: did:webvh:prod.ocmeregistry.com:creator:john-doe-music

Resolution

DID documents are persisted in canonical Cloudflare D1 storage (the legacy KV fallback is disabled) and resolve over plain HTTPS:

  • GET /creator/{id}/did.json
  • GET /member/{hash}/did.json
  • GET /showrunner/{slug}/did.json
  • POST /api/verify/did — resolves and cryptographically verifies any supported DID type in one call.

See the API Reference for request and response shapes.

Keys and Signatures

Verification keys

  • • RSA-2048 key pairs generated with WebCrypto
  • • Published in the DID document as RsaVerificationKey2018 with a PEM public key
  • • Private keys never leave the platform's managed key storage

Document proofs

  • • RSASSA-PKCS1-v1_5 with SHA-256 signatures over the canonicalized document
  • • Proof purpose: assertionMethod
  • • Verified internally on every resolution before the document is served

Public Redaction Boundary

Unauthenticated resolution serves a privacy-redacted view of documents that carry payment or legal-identity material: creatorData.paymentInfo (wallet address, legal name, country), #payment and #compliance service blocks, and staff audit-trail emails are stripped. When anything is stripped the document proof is removed with it and the response discloses the redaction. Documents without sensitive material are served untouched, proof including; authenticated paths always receive the full document.

Full details: Content Verification.