OpenID Shared Signals · SSF 1.0 · CAEP 1.0 · RISC 1.0
When something changes, everyone who needs to know, knows.
The Shared Signals Framework lets identity providers, SaaS apps, device managers and security tools tell each other about security-relevant changes — a revoked session, a compromised credential, a device falling out of compliance — in real time, using signed, standard events.
The specifications
Shared Signals Framework
The plumbing: streams, subjects, discovery, the management API, and how events are packaged and delivered.
SSF 1.0 →CAEP
Continuous Access Evaluation Profile — events for session and access decisions while a user is signed in.
8 event types →RISC
Risk Incident Sharing and Coordination — account-level events such as compromise, disablement and recovery.
13 event types →Start here
Concepts in ten minutes
Transmitters, Receivers, streams, SETs and subjects — the whole model on one page.
Event catalogue
Every CAEP, RISC and SSF event type with its claims and an example token.
Implementations
Products and open-source libraries that transmit or receive shared signals.
Playground
A public sample Transmitter and Receiver to test against. Coming soon.
The normative text lives at the OpenID Foundation Shared Signals Working Group. This site explains it; when the two disagree, the spec wins.