Verification
SD-JWT Verification
Verify Selective Disclosure JWT Verifiable Credentials
The Verification API supports SD-JWT VC (Selective Disclosure JWT Verifiable Credentials) alongside mDoc. SD-JWT credentials use JSON-based selective disclosure with Key Binding.
Requesting SD-JWT credentials
Use dc+sd-jwt as the format in your DCQL query:
{
"version": "v1",
"dcql_query": {
"credentials": [{
"id": "pid_sdjwt",
"format": "dc+sd-jwt",
"meta": {
"vct_values": ["eu.europa.ec.eudi.pid.1"]
},
"claims": [
{ "path": ["family_name"] },
{ "path": ["given_name"] },
{ "path": ["birth_date"] }
]
}]
}
}Key differences from mDoc
| Aspect | mDoc | SD-JWT |
|---|---|---|
| Claim path | ["namespace", "attribute"] | ["attribute"] |
| Metadata | doctype_value | vct_values (array) |
| Credential format | mso_mdoc | dc+sd-jwt |
Verification process
When a wallet submits an SD-JWT presentation, the API verifies:
- Issuer signature: The SD-JWT is signed by a trusted issuer (ES256)
- Disclosure hashes: Each disclosed claim matches its hash in the signed payload
- Key Binding JWT: The holder proves possession of the credential's confirmation key
- Nonce binding: The KB-JWT nonce matches the authorization request
- Audience: The KB-JWT audience matches the verifier's client_id
- Credential status: If the payload contains a
status.status_listclaim, the verifier fetches the issuer's Token Status List and checks that the credential has not been revoked or suspended
Accepting both formats
To accept either mDoc or SD-JWT for the same credential type, use credential sets:
{
"dcql_query": {
"credentials": [
{
"id": "pid_mdoc",
"format": "mso_mdoc",
"meta": { "doctype_value": "eu.europa.ec.eudi.pid.1" },
"claims": [
{ "path": ["eu.europa.ec.eudi.pid.1", "family_name"] },
{ "path": ["eu.europa.ec.eudi.pid.1", "given_name"] }
]
},
{
"id": "pid_sdjwt",
"format": "dc+sd-jwt",
"meta": { "vct_values": ["eu.europa.ec.eudi.pid.1"] },
"claims": [
{ "path": ["family_name"] },
{ "path": ["given_name"] }
]
}
],
"credential_sets": [
{
"options": [["pid_mdoc"], ["pid_sdjwt"]],
"required": true
}
]
}
}