Events & community · 3 min read
Identity Conferences Worth Following, and How to Get Value
Short answer
The events most identity practitioners follow are Identiverse (which grew out of the Cloud Identity Summit), the European Identity and Cloud Conference, the Internet Identity Workshop, FIDO Alliance's Authenticate, and the IETF and OpenID Foundation meetings where the specifications are written.
Key takeaways
- The Cloud Identity Summit was renamed Identiverse in 2018.
- Vendor-neutral standards work happens at IETF meetings, OpenID Foundation workshops and the Internet Identity Workshop.
- Pick an event by what you need: product evaluation, peer practice, or influence on standards.
Identity is a field where a handful of meetings shape the year. New specifications get debated in person, attacks get presented, and vendors show what they have built on top. If you want to keep up, it helps to know which event does what. Dates, locations and formats change, so treat this as a map and check each organizer's site before planning.
Which conferences focus on identity?
Identiverse, the European Identity and Cloud Conference (EIC) and Authenticate are the large identity-specific events; the Internet Identity Workshop is the main open-format gathering.
- Identiverse. A large North American identity conference. It began as the Cloud Identity Summit and was renamed Identiverse in 2018. Expect talks from practitioners, standards editors and vendors, with tracks for architecture, customer identity and workforce identity.
- European Identity and Cloud Conference (EIC). Run by the analyst firm KuppingerCole, usually in Germany. Strong on European regulation, digital identity wallets and governance.
- Authenticate. The FIDO Alliance's conference about passwordless authentication and passkeys.
- Internet Identity Workshop (IIW). An "unconference" held twice a year in California, where attendees set the agenda on the first morning. Many protocols, including parts of OpenID Connect and OAuth extensions, were sketched there.
- OAuth Security Workshop (OSW). A smaller, research-heavy event on OAuth and related protocol security.
Where are the standards actually written?
In IETF working groups, OpenID Foundation working groups, OASIS technical committees and W3C groups, mostly online and in the open.
| Body | Covers | How to follow |
|---|---|---|
| IETF OAuth WG | OAuth 2.0, 2.1 draft, DPoP, PAR, token formats | Mailing list, datatracker, meetings three times a year |
| OpenID Foundation | OpenID Connect, FAPI, Shared Signals, federation | Working group calls, published drafts |
| OASIS | SAML, XACML | Technical committee pages and archives |
| W3C | WebAuthn, Verifiable Credentials, Federated Credential Management | GitHub repositories, group pages |
| FIDO Alliance | FIDO2, passkey guidance | Specifications and white papers |
Our page on identity standards bodies and communities describes each in more detail.
How do I get real value out of attending?
Decide on one goal before you go, pick sessions accordingly and bring a concrete problem to discuss.
- Evaluating products? Use the expo with a list of requirements and ask for demos against your own scenario, not a scripted one.
- Learning practice? Favor case-study talks and hallway conversations with people at your scale.
- Influencing standards? Read the current drafts before you go, and join the working group list afterwards.
- Bringing knowledge home? Write a one-page summary for your team within a week, including which slides or recordings to watch.
How do I convince my manager to fund a conference?
Tie the trip to a decision or a problem the team already has.
"I want to learn about identity" is easy to refuse. "We are choosing between passkeys and security keys for admins next quarter, and several vendors and spec authors will be there" is not. Offer to bring back a written summary and run a short internal session. If budget is tight, compare the cost of one large conference with a year of local meetups, online workshops and a few standards calls; for many teams the second option teaches more.
Are online and local events worth it?
Yes. Local meetups and online sessions are cheaper, more frequent and often more practical than the big conferences.
Many cities have identity, API or security meetups, and OWASP chapters regularly cover authentication topics. For API-specific communities, see our overview of API security events and communities.
Wherever you learn, the fastest way to make a talk stick is to try the idea the next day. Decode the tokens your own system issues in the JWT Decoder and compare them with what the speaker recommended.
Questions
Which identity conference is best for developers?
For hands-on protocol discussion, the Internet Identity Workshop's open format and the OAuth Security Workshop are hard to beat. Larger conferences have developer tracks too, but more of their agenda targets architects and buyers.
Do I need to travel to follow standards work?
No. IETF working groups run on public mailing lists and publish meeting materials and recordings. The OpenID Foundation's working groups also hold open calls and publish drafts openly.