Skip to main content

Enable and Provision WIT-SVID

Allowing WIT-SVID issuance for an existing deployment requires two things: Defakto enables the feature for your organization, and your deployment's active signing key set must carry a WIT signing key.

1. Enable WIT-SVID for your organization​

WIT-SVID is off by default and is enabled per organization. Contact Defakto support to request it. Until it is enabled, the WIT Workload API endpoints return Unimplemented.

2. Provision the WIT signing key​

WIT-SVIDs are signed with a dedicated WIT signing key that lives on the trust domain deployment's active signing key set, separate from the X.509 and JWT signing keys. A WIT key is added to a key set only when that key set is created after WIT-SVID is enabled:

  • New trust domain deployments created after WIT-SVID is enabled get the WIT key automatically. No action required.
  • Existing trust domain deployments whose active key set was created earlier have no WIT key yet. Enabling the feature and configuring a policy is not enough on its own. You must create a new key set so it picks up the WIT key.

To create a new key set, follow the prepare, list, and activate steps in the Signing Key Rotation Runbook. This is the standard, self-service key-set rotation flow.

If you prefer not to rotate manually, the WIT key also appears at your next scheduled key-set rotation, at which point WIT issuance begins working automatically.

Understanding the error states​

Until a key set with a WIT key is active, requests to fetch a WIT-SVID fail with an Unavailable error:

WIT-SVID issuance is enabled but not yet available;
the signing key appears on the next key-set rotation

This is expected and temporary, not a misconfiguration. This error means the signing key has not been provisioned yet. The relevant setup errors are:

Error codeMeaning
UnimplementedWIT-SVID is not enabled for your organization.
UnavailableWIT-SVID is enabled, but the active key set has no WIT signing key yet. Roll a new key set or wait for the next scheduled rotation.
InvalidArgumentThe proof-of-possession key supplied with the request is invalid.

Order of operations for an existing deployment​

Next, configure a WIT-SVID policy.