Verification Gateway API
The Verification Gateway API lets you verify W3C Verifiable Credentials presented by holder wallets using the OpenID4VP (OpenID for Verifiable Presentations) protocol.
Verification Gateway was formerly VaaS (Verification as a Service). Only the name changed: hostnames, API paths and your integration stay the same. See the API Reference Overview.
All examples use vaas.stg.iden2.app. This host is for development and testing only. The staging spec declares HTTP-only schemes — this is a staging artifact. Always use HTTPS in production. Replace with your production host before going live. The production host is TBD — contact the iDen2 platform team.
Two API surfaces
Verification Gateway exposes two distinct API surfaces with different authentication models:
| API Surface | Auth Method | Called By |
|---|---|---|
| Verifier API | OAuth 2.0 Bearer token (client_credentials) | Your backend server |
| Wallet API | None (public, state-scoped) | Holder wallets |
Understanding client_metadata vs. client_id
The authorizationUrl returned by POST /api/v1/verifier/sessions contains two distinct identity parameters:
| Parameter | Location | Purpose |
|---|---|---|
client_id | Query param in authorizationUrl | Internal identifier used for KB-JWT audience validation. Not for display or trust lookup. |
verifier_member_id | Inside the client_metadata query param (JSON, URL-encoded) | Your verifier's identity in the iDen2 Trust Network. Holder wallets use this to look up and display your organisation during the consent screen. |
Your system does not need to parse or reconstruct the authorizationUrl — just pass it to the QR renderer. This note is for teams building custom wallet integrations or debugging trust network issues.
Errors
All error responses follow the RFC 9457 Problem Details schema shared across all iDen2 APIs.
Related guides
Authentication
- HTTP: Bearer Auth
OAuth 2.0 access token for Verifier API endpoints. Acquire a token from the iDen2 identity provider using the client_credentials grant and send it as Authorization: Bearer <access_token>. See the Authentication guide. Wallet API endpoints are public (session-scoped) and require no authentication.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | JWT |