Skip to main content

Verify a Credential

This integration guide describes how to request a verifiable credential from a user's wallet and check the result using the API. UniCore acts as the verifier and implements OpenID for Verifiable Presentations (OpenID4VP).

Typical scenarios are logging in with a credential instead of a password, checking a diploma during an application process, or verifying a membership before granting access.

Steps​

  1. Create an Authorization Request: Describe which credential you want to receive.

  2. Show a QR code: Let the user scan the request with their wallet.

  3. Check the result: Fetch the verified presentation once the user has shared their credential.

1. Create an Authorization Request​

Make a POST request to the /v0/authorization_requests endpoint. The dcql_query uses the Digital Credentials Query Language (DCQL) to describe which credential you are asking for:

{
  "state": "a2f1c7a0-5d0e-4c63-9a0f-7b9b1f3e2d11",
  "dcql_query": {
    "credentials": [
      {
        "id": "CredentialQuery",
        "format": "jwt_vc_json",
        "meta": {
          "type_values": [["VerifiableCredential"]]
        }
      }
    ]
  }
}
  • state is an identifier of your choice (e.g. a UUID) that you use to look up the result later. If you leave it out, a random value is generated. The path of the created request is returned in the Location header.
  • Narrow down the request by using a more specific type (e.g. ["OpenBadgeCredential"]) or by adding claims with the path of the attributes you need (e.g. ["credentialSubject", "first_name"]).

The response is a URL-encoded string starting with openid://, which compatible identity wallets know how to interpret.

2. Show a QR code​

Render the URL-encoded Authorization Request as a QR code with any QR code library of your choice. Make sure to use it exactly as provided without any further encodings or string manipulations (such as extra quotes).

On mobile, you can also use the string as a link that opens the wallet directly.

3. Check the result​

After the user has scanned the QR code and agreed to share their credential, the wallet sends a presentation to UniCore, which verifies it.

Make a GET request to /v0/authorization_requests/{state} to retrieve the result. As soon as the vp_token field is not null, the presentation has been received and verified. It contains the presented credentials, which you can now use in your application.

tip

Instead of polling, you can listen for the OID4VPAuthorizationResponseVerified event. See React to Events.