Skip to main content

Configuring Verifier Provider Backend

Procivis One supports operating as a verifier provider: an organization that distributes and manages mobile verifier apps for credential verification. The settings below control the app version lifecycle, verifier instance attestation, and enable trust ecosystem subscriptions.

Configuration​

verifierProvider:
  PROCIVIS_ONE:                            # Instance name (choose any identifier)
    type: PROCIVIS_ONE                     # Must be exactly "PROCIVIS_ONE"
    display: verifierProvider.procivisOne
    params:
      public:
        verifierName: "Example Verifier"

        integrityCheck:
          android:
            bundleId: com.example.verifier
            signingCertificateFingerprints:
              - "FA:C6:17:45:DC:50:D6:..."
            trustedAttestationCAs:
              - "-----BEGIN CERTIFICATE-----\n..."
          ios:
            bundleId: com.example.verifier
            trustedAttestationCAs:
              - "-----BEGIN CERTIFICATE-----\n..."
            enforceProductionBuild: true

        signerIdentifierTypes: ["CERTIFICATE"]

        appVersion:
          minimum: "v1.50.0"                    # Required minimum version. Earlier versions are blocked
          minimumRecommended: "v1.55.0"         # Recommended minimum version. End users are suggested to update the app
          reject:                               # Explicitly blocked versions
            - "v1.51.0"
          updateScreen:
            link: "https://example.com/update"  # URL for version update information

        featureFlags:
          ecosystemsEnabled: true
          ecosystemsEnforcementEnabled: false

App integrity verification​

integrityCheck:
  android:
    bundleId: com.example.verifier
    signingCertificateFingerprints:
      - "FA:C6:17:45:DC:50:D6:..."
    trustedAttestationCAs:
      - "-----BEGIN CERTIFICATE-----\n..."
  ios:
    bundleId: com.example.verifier
    trustedAttestationCAs:
      - "-----BEGIN CERTIFICATE-----\n..."
    enforceProductionBuild: true

integrityCheck applies once, to the verifier app as a whole. If it is configured, a verifier instance must pass it before it can register.

Signer identifier types​

signerIdentifierTypes: ["CERTIFICATE"]

Currently only CERTIFICATE is supported.

App version requirements​

Enforce minimum app versions and block specific releases:

appVersion:
  minimum: "v1.50.0"                     # Required minimum version. Earlier versions are blocked
  minimumRecommended: "v1.60.0"          # Recommended minimum version. End users are suggested to update the app
  reject:                                # Explicitly blocked versions
    - "v1.51.3"
  updateScreen:
    link: "https://example.com/update"   # URL for version update information

Automated syncing​

You can set up automated syncing of assets such as trust lists and schemas to managed verifier instances. See Configure Wallet Provider - Automated syncing for details.

Access certificate provisioning​

In the EUDI ecosystem, verifiers need Access Certificates to prove they are trusted to interact with EUDI wallets. You can configure automated Access Certificate provisioning to verifier instances.

verifierProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: verifierProvider.procivisOne
    params:
      public:
        accessCertificateConfiguration:
          providerUrl: 'https://example.com/api/access-cert-provider/certificate/v1/verifier-instance' # Your Desk/BFF deployment
          organisationId: '{{UUID}}' # Organisation that owns the verifier instances
          relyingPartyPublicIdentifier: '{{relying-party-identifier}}'
          relyingPartyNationalRegistry: '{{relying-party-registry-entry}}'
          issuerId: '{{UUID}}' # Issuer identifier
        signerIdentifierTypes: ["CERTIFICATE"] # The identifier type used to sign Access Certificates

User authentication and notifications​

You can extend verifier unit onboarding to include account creation with an identity provider, then use the Notification Service to communicate with end users.

verifierProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: verifierProvider.procivisOne
    params:
      public:
        ...
        userAuthentication:
          required: true              # If true, users must complete account creation to activate the verifier unit
          identityProvider: keycloak  # Configure an ID provider
          clientId: one-verifier
          redirectUri: https://verifier.example.com/auth/callback
          tokenValidation:
            aud: one-verifier
            iss: https://keycloak.example.com/realms/one
            jwksUri: https://keycloak.example.com/realms/one/protocol/openid-connect/certs

Usage​

The verifier app retrieves configuration and policy information from /ssi/verifier-provider/v1/{verifierProvider} to enforce version requirements and recommendations.

Next steps​