CASRAI Dictionary

Tag: crossref orcid

  • Researcher Unique Identifiers: How ORCID Links ISNI and VIAF

    A researcher unique identifier such as an ORCID iD resolves name ambiguity by acting as a bridge between the researcher-controlled scholarly record and the library world’s authority-control infrastructure — principally ISNI and VIAF — so that a catalogue entry, a national bibliography record, and a journal byline all point to the same verified person, even when names are shared, transliterated, or changed over time. This matters because author-name collision is a routine, measurable problem in large catalogues and citation databases.

    ORCID (Open Researcher and Contributor ID) is a free, persistent, 16-digit identifier that a researcher registers and controls directly, distinguishing them from every other person with a similar or identical name. ORCID is self-asserted, while ISNI and VIAF are authority-controlled — built by libraries, not by the individuals they describe. Understanding how these three systems interlock explains how name disambiguation actually works in catalogues, not just in publisher submission forms.

    What is a researcher unique identifier, and why does ambiguity matter?

    A researcher unique identifier is a persistent code — separate from a person’s name — that stays fixed even when a name changes, is spelled inconsistently, or is shared by many people. Catalogues holding millions of records inevitably contain multiple contributors named, for example, “J. Kim” or “M. Garcia,” and without a persistent identifier, a cataloguer or search algorithm has no reliable way to tell them apart.

    National bibliographies, institutional repositories, and citation indexes all depend on authority control — the library-science practice of establishing one authoritative name form and linking variants to it — and name collision undermines that practice. A researcher unique identifier gives authority control a machine-actionable anchor that survives name changes, script variation, and homonymy.

    How does ORCID differ from ISNI and VIAF?

    ORCID, ISNI, and VIAF solve overlapping problems under different governance models: ORCID is researcher-asserted, ISNI is registry-assigned and spans all creative and public identities, and VIAF aggregates national library authority files. None replaces the others — each addresses a different point in the identity-verification chain.

    ISNI (International Standard Name Identifier) is an ISO-certified global standard number — ISO 27729 — issued to the public identities of contributors across research, publishing, music, film, and the visual arts. Unlike ORCID, an ISNI is typically assigned by a registration agency drawing on authoritative sources such as library catalogues and rights-management data, not registered by the individual. VIAF (Virtual International Authority File), hosted by OCLC, combines name-authority files from dozens of national libraries into a single clustered record, so German, Japanese, and English catalogue name-forms for one researcher resolve to a single entry.

    System Governing standard / host Who assigns it Primary scope
    ORCID ORCID, Inc. (non-profit) The researcher, by self-registration Active researchers and contributors to scholarly output
    ISNI ISO 27729 Registration agencies, from authoritative source data Public identities across research, publishing, music, film, and visual arts
    VIAF OCLC (aggregation service) Automated clustering of national library authority files Name-authority records held by national and research libraries worldwide

    The Book Industry Study Group summarised the practical distinction in its October 2025 analysis: “ORCID specializes in the active research community, whereas ISNI provides broader coverage of public names across cultural sectors.” That division of labour is precisely why the two systems were designed to interoperate rather than compete.

    How do ORCID and ISNI interoperate?

    ORCID and ISNI interoperate through a formal, documented partnership, not an informal data-sharing arrangement. The two organisations issued a joint statement on interoperation on 22 April 2013, committing to link records and exchange public data so a researcher’s ORCID iD and ISNI can be cross-referenced automatically rather than matched by hand.

    A specific technical mechanism underpins this: ORCID was allocated an exclusive block of numbers within the ISNI numbering range, so ORCID-issued identifiers cannot collide with identifiers issued directly by ISNI registration agencies. Researchers can link an existing ISNI to their ORCID record, which then propagates into library authority files that consume ISNI data — including, per the Library of Congress’s 2013 discussion paper for the Program for Cooperative Cataloging, catalogues maintained through the NACO name-authority cooperative. The British Library was a founding partner in the ISNI project itself, which is why UK legal-deposit and national-bibliography workflows engaged with ISNI/ORCID linkage early.

    How does VIAF feed ISNI and national library catalogues?

    VIAF functions as the foundational aggregation layer that both ISNI and individual library catalogues draw on. Its clustering algorithms — built to match and merge name-authority records describing the same person across dozens of national libraries — were adapted to underpin ISNI’s own matching system when ISNI was established, per the scholarly literature on the two initiatives, including the 2014 IFLA analysis of ISNI and VIAF as tools for “trustfully consolidating identities.”

    In practical cataloguing terms, the chain typically runs as follows:

    • A national library creates or updates an authority record, drawing on VIAF to see how the name is represented across other libraries’ catalogues.
    • If an ISNI exists, or is newly assigned, it is added as a globally unique, persistent cross-reference.
    • If the researcher’s ORCID iD is linked to that ISNI, the library record connects to their self-maintained, current publication and affiliation history.
    • A catalogue user searching by name inherits the benefit automatically: variant name-forms and same-name collisions resolve to one confirmed identity.

    Crossref reinforces the same chain from the publishing side: its metadata schema captures ORCID iDs at deposit and auto-updates newly published works into a researcher’s ORCID record, keeping the researcher-asserted layer synchronised with the bibliographic layer that libraries later harvest into VIAF and ISNI-linked authority data.

    Answer-first Q&A: common questions about researcher identifiers

    Is ResearcherID the same as ORCID?

    No. ResearcherID is a Web of Science-specific identifier generated automatically when a researcher creates a Web of Science profile, tied to that publisher’s indexed content. ORCID is publisher-neutral, self-managed by the researcher, and can be attached to outputs from any publisher, including datasets, patents, and grants — not just Web of Science-indexed articles.

    What is a research identifier?

    A research identifier is a persistent, structured code assigned to a researcher, contributor, or their output to distinguish it unambiguously from similarly named people or works. Unlike a name, it does not change with marriage, transliteration, or spelling variation, which makes it the stable anchor that catalogues, funders, and publishers rely on for accurate attribution.

    Who provides an ORCID iD?

    ORCID, Inc., a non-profit organisation, issues ORCID iDs free of charge directly to individual researchers who self-register. Institutions, publishers, and funders do not assign ORCID iDs on a researcher’s behalf; they can only require or encourage registration and integrate the resulting identifier into their own systems, such as manuscript-submission or grant-application platforms.

    Are ORCID and Scopus ID the same?

    No. The Scopus Author Identifier is generated automatically by Elsevier’s Scopus database for any author with an indexed publication, whereas an ORCID iD is registered directly by the researcher and works across all publishers, not just those indexed in Scopus. Researchers can link the two, but each is maintained by a different organisation under a different assignment model.

    What does this mean for institutions and bibliographies?

    For research administrators and repository managers, the ORCID-ISNI-VIAF chain means catalogue-level disambiguation is no longer solely manual. Embedding an ORCID iD at deposit — in a repository record, thesis submission, or grant report — creates a traceable path into national authority files without extra cataloguer effort, provided the receiving system consumes ISNI or VIAF data.

    For national libraries, workloads increasingly consist of linking existing identifiers rather than establishing new name forms — less labour-intensive, though cataloguer judgement is still required where automated matching is ambiguous, such as with common transliterated names.

    The direction set out in the 2013 ORCID-ISNI joint statement — a shared scheme where one number represents an individual across both systems — remains the long-term goal, not the current default. Institutions building repository or CRIS infrastructure should treat ORCID capture as the entry point, ISNI/VIAF linkage as the library-side consequence, and Crossref metadata as the mechanism keeping the two synchronised as new outputs are published.

    CASRAI’s Dictionary of research administration terms maintains definitions for persistent identifiers and related concepts, and readers working on attribution practices more broadly may also find the CASRAI authorship resource pillar relevant background.

  • ORCID Authentication Explained: How Trust Markers Verify Publication Records

    ORCID authentication is the OAuth 2.0-based process that lets a researcher securely connect their ORCID iD to a publisher, funder or repository system and grant that trusted organisation permission to add or update entries on their record. Once authenticated, Crossref and DataCite can auto-update verified publication and dataset records directly, without manual re-entry by the author.

    ORCID is a non-profit organisation that issues a persistent, 16-digit researcher identifier — the ORCID iD, compatible with the ISO 27729 International Standard Name Identifier format — used across publishing, funding and repository systems to distinguish individuals who share similar or identical names. What makes the identifier useful in practice is not just its uniqueness but the authentication layer around it, which determines who is allowed to write to a researcher’s record and how that data is verified once it lands there.

    What Is ORCID Authentication?

    ORCID authentication is built on the industry-standard OAuth 2.0 protocol. ORCID’s own API documentation defines three distinct flows, each suited to a different integration pattern rather than one generic “login with ORCID” button.

    3-legged OAuth is the standard route for systems — manuscript-submission platforms, repository software, grant-management tools — that need standing permission to update a record over time. Implicit OAuth is a lighter, browser-only flow for sites that only need to confirm identity without write access. OpenID Connect sits on top of OAuth to supply a signed identity token that proves a user authenticated with ORCID at a specific moment.

    The practical difference between these flows is permission scope and token lifespan, and it directly affects how much a connected system can do with a researcher’s record:

    OAuth flow Permission level Token lifespan Typical use case
    3-legged OAuth Read and update (long-lived) Up to 20 years from issue Manuscript systems, repositories needing ongoing update rights
    Implicit OAuth Read-only, short-lived 10 minutes Browser-based sign-in widgets with no server backend
    OpenID Connect Identity verification layer over OAuth Session-based signed ID token Single sign-on / point-in-time identity confirmation

    ORCID’s API Tutorial documentation confirms that 3-legged OAuth access tokens are long-lived by default and expire 20 years after issue, while implicit-flow tokens are deliberately restricted to a 10-minute lifespan for security reasons. This asymmetry is deliberate: long-lived update rights are reserved for organisations that have gone through client registration, while anonymous or read-only integrations get a narrow, short window.

    How Do Crossref and DataCite Auto-Update ORCID Records?

    Auto-update solves a specific problem: researchers should not have to manually retype every publication onto their ORCID record. Crossref, the DOI registration agency most scholarly publishers use for journal articles, book chapters and conference papers, and DataCite, the equivalent registration agency for research data, datasets and software, both integrate directly with the ORCID registry to push metadata onto a record automatically once permission has been granted.

    The mechanism follows a fixed sequence:

    • An author submits a manuscript or dataset and supplies their authenticated ORCID iD — not simply a self-typed number.
    • The publisher or repository includes that ORCID iD in the metadata it deposits with Crossref or DataCite when registering the work’s DOI.
    • The first time a work carrying a researcher’s iD is registered, ORCID sends a one-time notification to that researcher’s ORCID inbox requesting standing permission to auto-update the record.
    • Once granted, Crossref or DataCite pushes that work — and every future work bearing the same iD from that source — directly onto the ORCID profile without further author action.

    This permission only needs to be granted once per source. Researchers can also pre-authorise DataCite proactively through their DataCite profile rather than waiting for the first notification. Either way, the update is initiated by the depositing organisation, not typed by the author — which is the detail that makes auto-updated entries structurally different from self-asserted ones.

    What Are ORCID’s Trust Markers, and Why Do They Matter for Record Integrity?

    Every entry ORCID displays carries a visible source label showing which organisation added it. When Crossref or DataCite pushes a publication or dataset via auto-update, that organisation’s name appears against the entry — a source-attribution signal this article refers to as a trust marker, distinguishing verified, third-party-asserted data from information a researcher typed in themselves.

    This distinction is the entire point of the mechanism. An ORCID record accepts three kinds of input: self-asserted entries a researcher adds manually, entries imported from a connected system with the researcher’s permission, and auto-updated entries pushed directly by a DOI registration agency once a work has been deposited under an authenticated iD. Only the third category carries an independent, verifiable chain of custody back to a registration agency’s own database — which is why it functions as a trust signal rather than a claim.

    ORCID reinforces this integrity model at the account level too. Researchers can enable two-factor authentication on their ORCID account, documented in ORCID’s Help Centre, and can review a “trusted organisations” list showing exactly which third-party applications hold update permissions, revoking any of them at any time. Together, authenticated deposit plus source-labelled display plus revocable permissions is what separates ORCID’s registry from a plain self-reported researcher directory.

    For institutions and publishers, this matters because a trust-marked record is auditable: a research office reconciling grant outputs, or a publisher checking an author’s prior work during peer review, can distinguish a Crossref-verified publication from an unverified claim without contacting the researcher directly.

    Answer-First Questions About ORCID Authentication

    How Do You Authenticate an ORCID iD?

    A user clicks a “Connect your ORCID iD” link on a partner site, is redirected to orcid.org to sign in, and then authorises the requested permission scope. ORCID returns an authorisation code, which the partner’s server exchanges for an access token tied to that specific record and scope.

    What Does ORCID Stand For?

    ORCID stands for Open Researcher and Contributor ID. It refers both to the non-profit organisation that runs the registry and to the persistent 16-digit identifier it issues, which distinguishes individual researchers from others who share similar or identical names across publications, grants and affiliations.

    Is ORCID Legitimate?

    Yes. ORCID is an established non-profit organisation whose registry is used by major publishers, funders, universities and DOI registration agencies including Crossref and DataCite as part of standard scholarly-publishing infrastructure. Its OAuth-based authentication and source-labelled auto-update system are designed specifically to make record data verifiable rather than self-reported.

    Do You Have to Pay for ORCID?

    No. Registering for a personal ORCID iD and using the public API to read or connect a record is free for individual researchers. Fees apply only to organisations that join as ORCID members to access the member API, which is required for write/auto-update permissions on institutional or publisher integrations.

    What This Means for Institutions, Publishers and Researchers

    For research administrators, trust-marked auto-update data is a lower-friction path to accurate outputs reporting as part of routine research administration workflows: reconciling grant deliverables against a Crossref-sourced entry requires less manual verification than reconciling against a self-typed CV line. Publishers integrating ORCID at submission or peer-review stage gain a verified identity check before a manuscript enters the editorial workflow, reducing name-disambiguation errors at the point of intake rather than after publication.

    The same authenticated-identity layer increasingly sits alongside other attribution infrastructure in scholarly publishing. Many journals now pair an authenticated ORCID iD with structured contributor-role tagging — for example CRediT, the taxonomy CASRAI originated in 2014 and which is now stewarded by NISO as ANSI/NISO Z39.104-2022 — so that both who contributed and what they did are captured with the same verification discipline. Reviewing how contributor roles are defined and tagged is a natural next step for any institution formalising its authorship verification standards.

    The direction of travel is toward less manually asserted metadata and more machine-verified provenance: as more publishers and repositories register for member API access, a growing share of any given ORCID record is populated by trust-marked, auto-updated entries rather than self-typed ones — narrowing the gap between what a CV claims and what a registration agency can independently confirm.