Back to Knowledge Hub Shared Signals & Risk

Shared Signals
& Risk

Real-time security event sharing across organizational boundaries. The OpenID Shared Signals Framework (SSF) enables interoperable risk signal exchange, fraud detection, and session management across trust ecosystems.

What Is the Shared Signals Framework?

The OpenID Shared Signals Framework (SSF) is a standard for sharing security events and risk signals in real time between entities that have a trust relationship. When an event occurs at one provider — a credential compromise, a suspicious login, a device change — SSF enables that provider to push an event notification to other providers who need to know.

SSF uses a stream-based model: event transmitters publish events to streams, and event receivers subscribe to relevant streams via configured delivery endpoints. This enables real-time security response without requiring polling or shared databases.

Core Concepts

SET (Security Event Token)

A JSON-based token format for representing security events. SETs are JWT-encoded, signed by the transmitter, and contain standardized event payloads. Events include credential change, session revocation, and risk assessment updates.

Streams & Delivery

Events are published to named streams. Each stream has a configurable delivery method (push via HTTP POST or pull). Receivers acknowledge events, and transmitters handle retry on failure. This ensures reliable delivery in distributed systems.

Transmitter & Receiver

The entity that detects and publishes events is the Transmitter. The entity that consumes events and takes action is the Receiver. An entity can be both — publishing events about users it manages while receiving events from partners.

Common Event Types

Account Credential Change

Password reset, MFA re-enrollment, API key rotation

Session Revoked

Force logout all sessions, device revocation, token invalidation

Risk Assessment

Identity risk score change, fraud indicator, anomalous behavior detection

Credential Compromise

Known breach exposure, credential stuffing detection, dark web finding

SSF + Digital Trust Ecosystems

In a digital trust ecosystem, SSF enables real-time risk intelligence sharing across participants. When a credential is compromised in one part of the ecosystem, every other participant is notified immediately. This is critical for:

→ Cross-border identity verification: If a national ID credential is revoked, relying parties in other countries are informed in real time.
→ Financial fraud prevention: Banks share risk signals about compromised accounts without sharing PII.
→ Healthcare data sharing: Consent revocation or provider credential changes propagate across the care network.