In short:An SVID, SPIFFE Verifiable Identity Document, is the credential that carries a SPIFFE ID. It comes as a short-lived X.509 certificate or a JWT. A workload presents its SVID to prove its identity to another service, and the SVID rotates before it expires.
How does it work?
The SPIFFE workload API issues and renews SVIDs. Receivers validate the signature against the trust domain.
What does it look like in practice?
Descope supports SPIFFE SVIDs as a way for agents to authenticate.