diff --git a/internal/proto/credential.proto b/internal/proto/credential.proto
index 5451d27b..f7236d48 100644
--- a/internal/proto/credential.proto
+++ b/internal/proto/credential.proto
@@ -43,7 +43,7 @@ enum CredentialType {
 // The shared credential is derived from local credential, and distributed to
 // remote devices based on the trust token for identity decryption and
 // authentication.
-// NEXT_ID=14
+// NEXT_ID=15
 // LINT.IfChange(SharedCredential)
 message SharedCredential {
   // The randomly generated unique id of the public credential.
@@ -94,5 +94,8 @@ message SharedCredential {
 
   // The tag for verifying metadata_encryption_key for a signed V1 adv.
   bytes metadata_encryption_key_signed_adv_tag = 13;
+
+  // The randomly generated positive unique id of the shared credential.
+  int64 id = 14;
 }
 // LINT.ThenChange(//depot/google3/google/internal/location/nearby/presence/v1/nearby_resources.proto:SharedCredential)
diff --git a/internal/proto/local_credential.proto b/internal/proto/local_credential.proto
index 29844c15..7fbcada0 100644
--- a/internal/proto/local_credential.proto
+++ b/internal/proto/local_credential.proto
@@ -28,6 +28,7 @@ option optimize_for = LITE_RUNTIME;
 // The local credential contains information of a local device for
 // identity encryption and authentication. It should never leave the generating
 // device.
+// NEXT_ID=11
 message LocalCredential {
   // Private encryption key descriptor.
   // Usually, either `certificate_alias` or `key` is set.
@@ -71,4 +72,8 @@ message LocalCredential {
 
   // The 16 bytes aes key to encrypt metadata in PublicCredential.
   bytes metadata_encryption_key_v1 = 10;
+
+  // The positive unique id of (and hashed based on) a pair of Secret Key and
+  // X509Certificate's public key.
+  int64 id = 11;
 }