Question 1

How do I verify a wallet credential?

Accepted Answer

The wallet-holder opens their credential + taps Verify (QR). You scan the QR with your phone camera - your browser opens vc-verify.html, which parses the SD-JWT VC from the URL fragment, fetches the issuer's public keys, and shows VALID or INVALID plus the disclosed attributes. No sign-in required.

Question 2

What does the verifier check?

Accepted Answer

ES256 signature against the issuer's published JWKS at .well-known/jwt-vc-issuer or vci.ashx?jwks; exp (expiry) and nbf (not-before) timing; SHA-256 hash of each selective disclosure against payload._sd; and if referenced, the OAuth Status List bit at the credential's idx (draft-ietf-oauth-status-list).

Question 3

Is scan-QR verification secure enough for remote authentication?

Accepted Answer

No. A copy of the QR is as verifiable as the original. Share-QR verification is the right pattern for door checks, discount validation, or peer-to-peer proof-of-membership where physical presence + face check backs it up. For remote authentication use OpenID4VP presentation - see verifier-integration-cookbook.html.

Question 4

Does the verifier see or log the credential?

Accepted Answer

No. The credential rides in the URL fragment (after the #), which the browser never sends to the server. All parsing, signature verification, and status-list checking happens in the verifier's own browser via WebCrypto.

Question 5

Which credential formats are supported?

Accepted Answer

SD-JWT VC (IETF draft-ietf-oauth-sd-jwt-vc), signed with ES256 (ECDSA P-256), the format shipped by CodeB tenants' VCI issuers. ISO 18013-7 mDoc via API-mediated transport is a follow-up.

Wallet credential verifier

No credential to verify

Credential summary

Disclosed attributes

Verification checks