Credential Manager Reference Architecture
Credential Manager Reference Architecture (CMRA).
The Credential Manager Reference Architecture (CMRA) is a FIDO Alliance baseline defining how digital wallets should meet functional, security and interoperability requirements. It is the basis of FIDO's wallet certification.
A relying party that accepts a mobile driver's licence or another wallet credential is trusting two things: the issuer that signed it and the wallet that stored and presented it. Issuer trust has frameworks. Wallet trust, until now, has mostly meant trusting the platform vendor. The CMRA is FIDO's attempt to make that second trust decision checkable, through a published baseline and a certification program built on it (FIDO announcement).
It was announced together with the Framework for Verifier Identification, which covers the opposite direction: how the wallet learns who the verifier is. Between them, the two documents describe both ends of a credential presentation.
Our reading. For a CIAM team the CMRA is a future input to wallet acceptance policy, not something to implement. Once certified wallets exist, a verifier can choose to accept credentials only from them, much as some relying parties restrict authenticators by attestation. FIDO had not published the document when this entry was written, so treat any specific requirement attributed to it as unconfirmed until the text is out. For the wider landscape, see decentralized identity for CIAM and the digital identity wallet entry.
Common questions
What is the FIDO Credential Manager Reference Architecture?
It is a FIDO Alliance document that sets a common baseline for how digital wallets implement functional, security and interoperability requirements. FIDO announced it on October 20, 2026, and said it underpins the FIDO Credential Manager Certification Program.
Is a credential manager the same as a passkey manager?
In this document FIDO uses credential manager to mean a digital wallet that holds and presents digital credentials such as national IDs, payment and travel credentials. Some products may do both, but the CMRA as announced is scoped to wallets for digital credentials, not to passkey sync.
Can I read the CMRA today?
At announcement FIDO said the working documents would be made public in the coming weeks. Check FIDO's digital credentials page for the published version before relying on any specific requirement.
Why does a CIAM team care about wallet certification?
When a CIAM flow accepts a credential from a wallet, the relying party inherits the wallet's security. A certification baseline gives verifiers a way to decide which wallets to trust without auditing each one.
Related terms
In the guides
Decentralized Identity and Verifiable Credentials: What CIAM Teams Should Know
EUDI Wallet rolls out in 2026. US mDL adoption is uneven but real. DID and VC are no longer research projects. The CIAM-side impact, and when to start integrating.
Identity Verification and Proofing (IDV/KYC): A CIAM Guide for 2026
How to prove a real person matches a claimed identity at signup: document capture, liveness, authoritative-data checks. The 2026 stack, the deepfake escalation, and where CIAM ends.