VC Validator

Interactive example

Validate a Verifiable Credential (VC) or a Verifiable Presentation (VP) using our libraries.

Format

JWT VCJWT VP

VCDM Version

VCDM 1.1VCDM 2.0

Input

Paste a JWT or .

Result

Source code

This validator uses the open-source library @europeum-ebsi/verifiable-credential. You can install it with your package manager:

Console

# with npm
npm i @europeum-ebsi/verifiable-credential
# with pnpm
pnpm add @europeum-ebsi/verifiable-credential
# with yarn
yarn add @europeum-ebsi/verifiable-credential

In your code, you can now validate the input by using the vcdm20.js entry point:

JavaScript code

import { ValidationError } from "@europeum-ebsi/verifiable-credential";
import { verifyCredentialJwt } from "@europeum-ebsi/verifiable-credential/vcdm20.js";

const config = {
  hosts: ["api-test.testnode02.ebsi.eu"],
  network: { name: "test" },
  scheme: "ebsi",
  services: [
    "authorisation",
    "contracts-registry",
    "did-registry",
    "issuers-registry",
    "ledger",
    "policies-registry",
    "schemas-registry",
    "timestamp",
    "track-and-trace",
  ],
  version: "v1",
};

try {
  const credential = await verifyCredentialJwt(
    jwt,
    config,
  );
  console.log(credential);
} catch (error) {
  if (error instanceof ValidationError) {
    console.error(error.message);
  } else {
    throw error;
  }
}

---

Library

The validator uses two open-source packages:

• @europeum-ebsi/verifiable-credential validates JWT VCs.
• @europeum-ebsi/verifiable-presentation validates JWT VPs, including every credential they embed.

Entry points

Each package has three entry points:

Entry point	Content
.	Shared types, EbsiEnvConfiguration and the error classes
./vcdm11.js	verifyCredentialJwt / verifyPresentationJwt for VCDM 1.1
./vcdm20.js	verifyCredentialJwt / verifyPresentationJwt for VCDM 2.0

Functions

verifyCredentialJwt(jwt: string, config: EbsiEnvConfiguration, options?: VerifyCredentialOptions)
verifyPresentationJwt(jwt: string, audience: string, config: EbsiEnvConfiguration, options?: VerifyPresentationJwtOptions)

config describes the EBSI environment: hosts, network ({ name: "test" }), scheme ("ebsi"), services (the list of EBSI services to trust) and version ("v1"). The Source code tab of the validator shows a complete example.

Options

Both functions share these options:

Option	Description
validAt	Unix timestamp used instead of the current time to check validity
clockSkew	Seconds of tolerance applied around nbf and exp (default 0)
timeout	Timeout of the HTTP requests sent to EBSI services
axiosHeaders	Custom headers added to those requests
proofPurpose	Verification relationship the signing key must hold (default assertionMethod)
didRegistryContractAddress	Target a specific DID Registry instance. DIDs must prove they belong to it
issuersRegistryContractAddress	Target a specific Issuers Registry instance

verifyCredentialJwt also accepts skipAccreditationsValidation, skipAccreditationWithoutTermsOfUseValidation, skipCredentialSubjectValidation, skipStatusValidation and extraCredentialSchemaTypes. The VCDM 1.1 version adds skipTrustedIssuerValidationForSelfIssuedCredentials.

verifyPresentationJwt also accepts maxIatAge (maximum age of the iat claim), skipHolderDidResolutionValidation, skipHolderDidRegistryProvenanceCheck and verifyCredentialOptions (options applied to each embedded credential). The audience is a positional argument: it must match the aud claim of the presentation.

Errors

Error	Meaning
ValidationError	Base class of validation failures
JsonSchemaValidationError	The input does not match its JSON Schema. ajvErrors lists the violations
JsonSchemaLoadingError	A schema could not be loaded
ConfigurationError	The environment configuration is invalid
EbsiServiceMismatchError	A URL does not point to the expected EBSI service

note

Schema, accreditation and status list URLs found in a credential (such as credentialSchema.id) must be trusted EBSI URLs: they must use the configured host and the expected service, and any query string or fragment is ignored.