SD-JWT verification with TypeScript

SD-JWT lets an issuer commit to credential claims while allowing a holder to share selected disclosures. In a presentation, the verifier checks the issuer signature, each disclosed claim against its digest, and—when the profile requires holder binding—the holder's Key Binding JWT.

Selective disclosure reduces which claims are sent. It does not hide claims that the holder chooses to disclose, and it is not by itself a zero-knowledge proof. Request only the information needed for the transaction.

Request a credential and its required claims

Use the vc+sd-jwt format when the accepted credential is an SD-JWT VC. The issuer identifier and claim names must match the issuer and profile configured for your account.

import { EidClient } from "@dlbr/eid-sdk";

const id = new EidClient({
  baseUrl: process.env.DLBR_ID_BASE_URL!,
  apiKey: process.env.DLBR_ID_API_KEY!,
  mode: "test",
});

const session = await id.sessions.create({
  credentials: [{
    id: "pid",
    format: "vc+sd-jwt",
    issuer_id: "https://issuer.example",
    vct_values: ["urn:eudi:pid:1"],
    claims: ["given_name", "family_name"],
  }],
});

// Render this URL as a QR code or link for the user to open in a wallet.
console.log(session.session_id, session.qr_code_url);

Keep the SDK and API key in a trusted server-side runtime. The browser should receive only the public wallet request URL and an opaque session identifier.

Verify before using disclosed claims

After the wallet responds, retrieve the session through the authenticated backend client. Use the returned claims only when the session status is VERIFIED; handle pending, failed, and expired sessions separately. Avoid logging the raw presentation or disclosed claim values.

The Gateway checks the configured issuer trust and the presentation's cryptographic bindings before exposing requested claims. A rejected signature, invalid disclosure, wrong issuer, or a mismatched holder binding must not be treated as a successful identity check.

SD-JWT and SD-JWT VC are related specifications

RFC 9901 specifies the SD-JWT selective-disclosure format. The SD-JWT VC profile defines how that format is used for verifiable credentials and is tracked separately by the IETF OAuth working group. Check the current profile and the issuer's metadata when implementing an ecosystem-specific credential.

DLBR's supported credential formats, issuer trust setup, and claim mappings are described in the advanced OID4VP guide. Continue with the SDK quickstarts or the OID4VP nonce and state guide, or compare SD-JWT VC with ISO mdoc.