Wallet credential verifier
Anyone can scan a wallet-holder's verification QR and land on this page. It parses the credential, fetches the issuer's public keys, checks the signature and the expiry, and shows you whether it is currently valid. No sign-in required. The credential itself lives entirely in the URL fragment (never touches the server logs).
This is a lightweight "share-QR" verifier. It confirms that (a) the credential was signed by the claimed issuer, (b) it has not expired, and (c) the disclosed attributes match the signature. It is right for door checks, discount validation, or peer-to-peer proof-of-membership. It is not a substitute for a full OpenID4VP presentation (which additionally binds the credential to a fresh verifier-supplied nonce and to the wallet's holder key) — use OID4VP when you need remote authentication.
Frequently asked questions
How do I verify a wallet credential?
The wallet-holder opens their credential + taps Verify (QR). You scan the QR with your phone camera - your browser opens vc-verify.html, which parses the SD-JWT VC from the URL fragment, fetches the issuer's public keys, and shows VALID or INVALID plus the disclosed attributes. No sign-in required.
What does the verifier check?
ES256 signature against the issuer's published JWKS at .well-known/jwt-vc-issuer or vci.ashx?jwks; exp (expiry) and nbf (not-before) timing; SHA-256 hash of each selective disclosure against payload._sd; and if referenced, the OAuth Status List bit at the credential's idx (draft-ietf-oauth-status-list).
Is scan-QR verification secure enough for remote authentication?
No. A copy of the QR is as verifiable as the original. Share-QR verification is the right pattern for door checks, discount validation, or peer-to-peer proof-of-membership where physical presence + face check backs it up. For remote authentication use OpenID4VP presentation - see verifier-integration-cookbook.html.
Does the verifier see or log the credential?
No. The credential rides in the URL fragment (after the #), which the browser never sends to the server. All parsing, signature verification, and status-list checking happens in the verifier's own browser via WebCrypto.
Which credential formats are supported?
SD-JWT VC (IETF draft-ietf-oauth-sd-jwt-vc), signed with ES256 (ECDSA P-256), the format shipped by CodeB tenants' VCI issuers. ISO 18013-7 mDoc via API-mediated transport is a follow-up.