A significant event in digital identity occurred without fanfare today. Presentation Exchange was removed from the OpenID for Verifiable Presentations specification. It had once-upon-a-time been the only query language used for verifiable credential presentation. In October 2024, the Digital Credential Query Language (DCQL) was added alongside it. Today, after much discussion by the working group, Presentation Exchange was removed, making DCQL the only query language supported. Importantly, this was done before OpenID4VP became a final specification.
Replacing Presentation Exchange (PE) has been a multi-year journey. I’ve been advocating for its replacement for years, including leading two sets of unconference discussions titled “What does Presentation Exchange do and what parts of it do we actually need?” – one in August 2023 at the OAuth Security Workshop and one in October 2023 at the Internet Identity Workshop. These discussions were intended to create awareness of the need to replace PE and start building consensus for its removal. Others also took this position early with me, including Tobias Looker and Oliver Terbu. Daniel Fett and Brian Campbell were receptive to the possibility early as well.
Removing a feature that people had taken a dependency on is not without pain. Numerous prototype wallets and verifiers used parts of it. But that’s the rub. There was so much there in Presentation Exchange that most implementations didn’t use most of it. As a result, interoperability, while possible, was a tricky and sometimes elusive target.
Presentation Exchange was ambitious in scope. It was a Swiss Army Knife of a specification. A goal was to enable complex queries for multiple credentials based on a general-purpose query language intended to be able to be used over credentials represented in JSON in any way. You could even include attributes of credentials other just their claims in the queries, such as algorithms and formats. You could ask for 2 of this or 3 of that and one or more of the following, as long as it is in format X, Y, or Z. It didn’t follow one of my guiding standards principles: “Keep simple things simple.” As a result, negative feedback from implementers grew over time.
Now we have a purpose-built query language designed for the task and protocol at hand. Is it as simple as it could be? No. Are all the features motivated by real-world non-hypothetical use cases? Yes.
The creation of DCQL was led by Daniel Fett. A precursor query language that helped inform DCQL was created by Oliver Terbu, Tobias Looker, and myself. Discussions at the Internet Identity Workshop informed what became DCQL, as did discussions at the IDUnion hackathon in Nürnberg in 2024 that included Kristina Yasuda, Christian Bormann, and Paul Bastian.
You can see OpenID4VP when PE was the only query language, when it had both query languages, and now with only DCQL. Compare for yourself.
Let me close by saying that I respect the people who created Presentation Exchange to a person. I count many of them as friends. They took a complex multi-faceted problem and wrapped their arms around it, producing a concrete solution. Much can be said in favor of those who pick up the pen and dare to create. Much was learned from what they produced, and it helped bootstrap an emerging industry. We wouldn’t be where we are today, were it not for their pioneering efforts!
In the end, the removal happened unceremoniously, with the merge of a pull request, like so many other changes – nearly anticlimactic. But this one marks a sea change in how credentials are presented. Thanks to all who made this happen!
I didn’t want to let the moment pass without recognizing its significance.
Duende Software just posted an insightful piece titled Essential Moments in the OAuth and OpenID Connect Timeline. It’s a trip down memory lane, recounting significant developments in the identity and security standards repertoire that we now take for granted.
