Skip to main content

Configure Verifier Provider

Procivis One supports operating as a verifier provider: an organization that distributes and manages mobile verifier apps for credential verification. The settings below control the app version lifecycle, verifier instance attestation, and enable trust ecosystem subscriptions.

Configuration​

verifierProvider:
  PROCIVIS_ONE:                                 # Must match exactly
    params:
      public:
        verifierName: "My Verifier"
        verifierInstanceAttestation:
          expirationSeconds: 86400
          integrityCheck:
            android:
              bundleId: com.example.wallet
              signingCertificateFingerprints:
                - "FA:C6:17:45:DC:50:D6:..."
              trustedAttestationCAs:
                - "-----BEGIN CERTIFICATE-----\n..."
            ios:
              bundleId: com.example.wallet
              trustedAttestationCAs:
                - "-----BEGIN CERTIFICATE-----\n..."
              enforceProductionBuild: true
        appVersion:
          minimum: "v1.50.0"                    # Required minimum version. Earlier versions are blocked
          minimumRecommended: "v1.55.0"         # Recommended minimum version. End users are suggested to update the app
          reject:                               # Explicitly blocked versions
            - "v1.51.0"
          updateScreen:
            link: "https://example.com/update"  # URL for version update information
        featureFlags:
          ecosystemsEnabled: true
          ecosystemsEnforcementEnabled: true

The appVersion block lets you enforce version requirements and notify users of available updates.

Automated syncing​

You can set up automated syncing of assets such as trust lists and schemas to managed verifier instances. See Configure Wallet Provider - Automated syncing for details.

Access certificate provisioning​

In the EUDI ecosystem, verifiers need Access Certificates to prove they are trusted to interact with EUDI wallets. You can configure automated Access Certificate provisioning to verifier instances.

verifierProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: verifierProvider.procivisOne
    params:
      public:
        accessCertificateConfiguration:
          providerUrl: 'https://example.com/api/access-cert-provider/certificate/v1/verifier-instance' # Your Desk/BFF deployment
          organisationId: '{{UUID}}' # Organisation that owns the verifier instances
          relyingPartyPublicIdentifier: '{{relying-party-identifier}}'
          relyingPartyNationalRegistry: '{{relying-party-registry-entry}}'
          issuerId: '{{UUID}}' # Issuer identifier

User authentication and notifications​

You can extend verifier unit onboarding to include account creation with an identity provider, then use the Notification Service to communicate with end users.

verifierProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: verifierProvider.procivisOne
    params:
      public:
        ...
        userAuthentication:
          required: true              # If true, users must complete account creation to activate the verifier unit
          identityProvider: keycloak  # Configure an ID provider
          clientId: one-verifier
          redirectUri: https://verifier.example.com/auth/callback
          tokenValidation:
            aud: one-verifier
            iss: https://keycloak.example.com/realms/one
            jwksUri: https://keycloak.example.com/realms/one/protocol/openid-connect/certs

Usage​

The verifier app retrieves configuration and policy information from /ssi/verifier-provider/v1/{verifierProvider} to enforce version requirements and recommendations.

Next steps​