Short-lived, automatically issued identities for software workloads, based on attested properties instead of shared secrets.
SPIFFE defines identities (SPIFFE IDs) and documents that carry them (SVIDs). SPIRE implements it: node attestation proves the machine, workload attestation proves the process, and short-lived SVIDs rotate continuously.
Normally a SPIRE agent does not re-attest on a simple restart, because it keeps its keys and SVID on disk. Re-attestation happens when that state is lost, when the SVID expired during downtime, or when configuration changes.
Example. A payment service starts in a cluster. It receives a one-hour identity because its node and image were verified. No password is stored anywhere.
Attested AI agentsAttested cloud workloads
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.