Sign upLog in

Verifying credentials

A verifiable credential is only useful if anyone can check it. This page explains what a verification actually checks and the three ways to verify a credential issued through Inflowra.

What a verification checks

  1. Structure — the input parses as a credential at all: a compact JWT string (header.payload.signature) or a JSON-LD credential document.
  2. Signature — the credential's proof is checked against the issuer's public key, resolved from the DID in the credential (the verification method, e.g. did:web:vci.inflowra.com#key-1). A tampered payload or a key mismatch fails here.
  3. Revocation status — the credential is checked against the issuer's status list. A credential can be cryptographically intact yet revoked.
  4. Validity window — valid_from (and expiry, where present) are compared against the time of the check.

A credential is reported valid only when all checks pass. The result always carries a human-readable reason.

Three ways to verify

1. The public verify portal

For spot checks, paste a credential into the verify portal and read the result — validity, reason, issuer DID, credential type, subject, and revocation status. No account needed.

TODO: confirm — public URL of the verify portal once deployed.

2. The hosted verify API

For programmatic checks, POST the credential to the public verify API. Public, no auth, CORS-restricted to allowlisted origins.

3. Your own stack

Because Inflowra issues standard formats (SD-JWT, mdoc, JSON-LD), any compliant verifier works — walt.id, Credo-TS, or your own code resolving the issuer DID and checking the proof. No call to Inflowra is required.

Revocation

Issuers revoke credentials via hosted status lists (included on paid plans). Verifiers see revocation through the revocation object in the verify API response: checked (the status list was consulted) and flagged (the credential is revoked). A verification with revocation.checked: false means validity was assessed on signature alone.

TODO: confirm — how issuers trigger a revocation today (portal action vs. API call).