Credentials includes both webId and Origin, right?

[michielbdejong]

Credentials includes both webId and Origin, right?

[RubenVerborgh]

Yes, or even more actually. For instance, it could be beneficial to add the mode of authentication to the credentials: some very sensitive resources might require two-factor authentication.

I see Credentials as an object that can and likely will evolve; and the good thing is that there is only one touch point, namely Authorizer. So if Credentials changes, only the Authorizer will need to be adapted; other components can be reused as-is.