Skip to main content

DIV – Bring Your Own Wallet

Last updated on by thomas-t7

Bring Your Own Wallet (BYOW) is a provisioning model for SAP Decentralized Identity Verification (DIV) in the context of dataspaces such as Catena-X. It describes how a dataspace member self-provisions their own DIV instance on SAP BTP, rather than receiving a managed wallet from the Operating Company.

Background​

Until the beginning of 2024, only the Operating Company (e.g., Cofinity-X in the Catena-X network) could provision and operate a DIV wallet on behalf of dataspace members. Members had no direct access to DIV as an SAP BTP service — they relied entirely on the operator for identity and credential management.

With the introduction of BYOW in 2026, dataspace members can now provision DIV directly from their SAP Integration Suite subscription via the Data Space Integration (DSI) capability. This fundamentally changes the ownership model: the member controls their own wallet infrastructure on SAP BTP, while the operator retains its role as the trusted issuer for the membership credential.

Architecture​

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

In the BYOW model, the Operating Company's DIV wallet acts as the issuer of the membership credential. After verifying the member's identity, the operator issues a signed membership credential and pushes it directly to the member's own DIV wallet hosted on their SAP BTP account.

From that point on, the member uses their own DIV wallet autonomously to participate in the dataspace — authenticating with partners, presenting credentials, and exchanging data via the Data Space Integration and the IATP protocol.

Key Advantages​

Member Controls Their Own Wallet​

The DIV wallet runs in the member's own SAP BTP account. The member manages their company identity, DID, subscriptions, and credential lifecycle independently — without depending on the operator for day-to-day operations.

Reduced Dependency on the Operating Company​

In the traditional model, the operator was the bottleneck for all wallet operations. With BYOW, the operator's role is limited to issuing the initial membership credential. All subsequent credential operations — issuance, verification, data exchange — are handled autonomously by the member's own wallet.

Direct Integration with SAP Integration Suite​

BYOW wallets can be provisioned as part of the Data Space Integration (DSI) capability within SAP Integration Suite. This enables automated wallet setup, bootstrapping of company identity and DID, and direct integration with SAP's data space connector infrastructure — without manual configuration steps.

Preserved Trust Model​

Although the wallet is self-hosted, the trust model of the dataspace is fully preserved. The membership credential is still issued by the trusted Operating Company and cryptographically verifiable by all dataspace partners. Partners can validate the credential by resolving the operator's DID from the network — no central runtime dependency on the operator is required.

Scalability for Large Dataspaces​

BYOW removes the scaling bottleneck from the Operating Company. As more organizations join a dataspace, each member provisions and operates their own wallet — the operator infrastructure is not a single point of failure or congestion.

Services and Components​

Resources​