WIMSE Identity Demo — cross-cloud payment processing

Full WIMSE Journey

A payment transaction triggers a cross-cloud authentication chain. No passwords. No pre-shared secrets. Each service cryptographically proves its identity at every hop.

Each run generates fresh cryptographic keys and tokens — every execution is unique.
✓ Transaction completed — full identity chain verified

Workload Identity Token (WIT)

A WIT is a signed JWT that proves a workload's SPIFFE identity. Unlike a password, it is cryptographically bound to the workload's own key pair — it can only be used by the entity that holds the private key.

Workload Authorization Grant (WAG)

WAG lets a workload get an OAuth access token with zero pre-registration at the AS. The platform (SPIRE) registers once. Every workload it vouches for is accepted automatically — critical for ephemeral containers and AI agent fleets.

Architecture

Three Go services, each a Dockerfile. Three Fly.io VMs on the free tier. One Cloudflare Pages SPA. All inter-service calls use real HTTP with real JWTs.

Service map
Platform (Fly VM 1) SPIRE sim :8081 Auth Server :8082 Workload (Fly VM 2) transaction-processor :8083 APIs (Fly VM 3) fraud-api :8084 compliance :8085 WIT+WAG Bearer+WPT SPA (Cloudflare Pages) — calls workload :8083 to trigger the full flow
Run locally with Docker
git clone https://github.com/jralmaraz/wimse-demo
cd wimse-demo
docker compose up

# Services available at:
#   SPIRE sim   → http://localhost:8081
#   Auth Server → http://localhost:8082
#   Workload    → http://localhost:8083
#   Fraud API   → http://localhost:8084
#   Compliance  → http://localhost:8085
#   SPA         → http://localhost:3000

# Point the SPA at local services:
# http://localhost:3000?backend=http://localhost:8083