Portable Credentials: What the Term Means in Practice
Digital identity should work across state lines, agency boundaries, and program transitions. Here is what that actually requires.
The term ‘open source’ appears in government technology procurement with increasing regularity. RFPs ask for it, legislators mention it in committee hearings, and agency leaders list it as a preference. And for good reason, it represents real values that matter for public infrastructure.
But what it actually means in the context of a digital identity system, and what it does and does not guarantee, is worth unpacking.
What Open Source Means
When a digital identity system is described as open source, it means the source code (for the credential issuer, the wallet application, the verifier, or some combination) is publicly available and can be inspected. What else is permitted, such as modification, redistribution, and commercial use, depends on the specific license the code is published under. Not all open source licenses allow the same things, and that distinction matters for how agencies can use and build on the code.
That said, the core property, source code that can be read and audited by anyone, offers three things that are genuinely valuable for government programs.
First, an independent security review becomes possible. Researchers, auditors, and other agencies can examine the code directly rather than relying solely on vendor-provided documentation. Security issues can be identified and reported by a broader community, not just an internal team.
Second, the agency has visibility it would not otherwise have. Understanding how a system is built - what data it handles, how credentials are signed, what gets transmitted and where, is meaningful for procurement, oversight, and accountability.
Third, open source creates the conditions for longer-term flexibility. Depending on the license, another vendor or the agency itself may be able to take the code in a different direction if circumstances change, a protection against the kind of lock-in that has created difficult situations for agencies with legacy systems. This connects naturally to the interoperability without lock-in principle that underlies a sound long-term procurement strategy.
These are some of the reasons open source matters specifically for public infrastructure. Not as a technical preference, but as a foundation for the accountability and transparency that government programs are built on.
What Open Source Does Not Automatically Provide
Open source is an important procurement consideration, but it should not be mistaken for a complete operating model.
Open source code that is not actively maintained has limitations. A credential system whose codebase has not received meaningful updates for a significant period may have vulnerabilities that are not being addressed. Visibility alone does not keep a system current.
Open source without a governance model leaves some important questions open. Who maintains the roadmap? Who reviews contributions? Who is responsible for issuing security patches? A well-governed project with clear processes is a different kind of asset than one with no formal accountability structure.
And open source without an operational support model means an agency may have access to the code but not the internal capacity to run or maintain it. For many agencies, the practical path is working with a vendor - one that builds on and supports open source infrastructure, rather than maintaining a proprietary system.
What Open Source Looks Like in Practice
There is a meaningful difference between vendors who simply publish their code and vendors who maintain open source projects with clear processes, accountability, and long-term stewardship.
A governance-oriented approach means security patches are issued through a documented process the community can plan around, and the project has a clear structure for how decisions are made and how issues are resolved. A vendor whose open-source libraries underpin a deployed government credential system and who approaches open source this way is building something the agency can rely on over time.
Building with verifiable digital credentials requires specialized knowledge. When vendors make their libraries openly available and well-documented, they lower the barrier for other agencies, developers, and implementers to build on the same foundation. That matters because digital identity infrastructure works better when more participants can inspect, understand, and build on shared components. We believe an open source approach builds trust and accountability across the full ecosystem, not just between a vendor and a single agency, but across the broader community of implementers and users who depend on these systems working reliably and transparently.
A practical checklist for future-proofing state digital infrastructure, like the one published here, can help agencies think through what to look for when evaluating vendors on this dimension.
A Foundation Worth Building On
Open source is worth prioritizing, and it genuinely supports the goals most agencies have in mind: independent auditability, reduced dependency, and the ability to build on shared infrastructure rather than rebuilding the same core systems for every new program.
The license terms, governance model, and support structure together determine whether an open-source system is a durable foundation. When those things are in place, the value of open source in government digital identity goes beyond the code being visible, it is that visibility enabling accountability, and accountability building the kind of trust that public infrastructure requires.
At SpruceID, we believe government digital identity systems should be built on that kind of foundation: open, accountable, actively maintained, and designed for long-term public trust. If your agency is evaluating digital identity infrastructure, we’d be glad to help you understand what open source can make possible.
Building digital services that scale take the right foundation.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
