Skip to main content

Configure Verifier Provider

Procivis One supports operating as a verifier provider: an organization that distributes and manages mobile verifier apps for credential verification. The settings below control the app version lifecycle, verifier instance attestation, and enable trust ecosystem subscriptions.

Configuration​

verifierProvider:
  PROCIVIS_ONE:                                 # Must match exactly
    params:
      public:
        verifierName: "My Verifier"
        verifierInstanceAttestation:
          expirationSeconds: 86400
          integrityCheck:
            android:
              bundleId: com.example.wallet
              signingCertificateFingerprints:
                - "FA:C6:17:45:DC:50:D6:..."
              trustedAttestationCAs:
                - "-----BEGIN CERTIFICATE-----\n..."
            ios:
              bundleId: com.example.wallet
              trustedAttestationCAs:
                - "-----BEGIN CERTIFICATE-----\n..."
              enforceProductionBuild: true
        appVersion:
          minimum: "v1.50.0"                    # Required minimum version. Earlier versions are blocked
          minimumRecommended: "v1.55.0"         # Recommended minimum version. End users are suggested to update the app
          reject:                               # Explicitly blocked versions
            - "v1.51.0"
          updateScreen:
            link: "https://example.com/update"  # URL for version update information
        trustCollections:
          - id: 00000000-0000-0000-0000-000000000000
            logo: "https://example.com/trust-collection-logo.png"
            defaultSelected: true   # If true, this collection will be selected by default during onboarding
            displayName:
              en: "Example Trust Ecosystem"
            description:
              en: "Credentials issued by members of this ecosystem meet Example's trust requirements."
        featureFlags:
          trustEcosystemsEnabled: true

The appVersion block lets you enforce version requirements and notify users of available updates.

Trust collections define the trust ecosystems available to verifier app users. See Configure Wallet Provider for a full description of the trustCollections fields.

Access certificate issuance​

You can configure Access Certificate issuance to verifier instances.

walletProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: walletProvider.procivisOne
    params:
      public:
        accessCertificateConfiguration:
          providerUrl: 'https://example.com/api/access-cert-provider/certificate/v1/verifier-instance' # Your Desk/BFF deployment
          organisationId: '{{UUID}}' # Organisation that owns the verifier instances
          relyingPartyPublicIdentifier: '{{relying-party-identifier}}'
          relyingPartyNationalRegistry: '{{relying-party-registry-entry}}'
          issuerId: '{{UUID}}' # Issuer identifier

User authentication and notifications​

You can extend verifier unit onboarding to include account creation with an identity provider, then use the Notification Service to communicate with end users.

walletProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: walletProvider.procivisOne
    params:
      public:
        ...
        userAuthentication:
          required: true              # If true, users must complete account creation to activate the wallet unit
          identityProvider: keycloak  # Configure an ID provider
          clientId: one-wallet
          redirectUri: https://wallet.example.com/auth/callback
          tokenValidation:
            aud: one-wallet
            iss: https://keycloak.example.com/realms/one
            jwksUri: https://keycloak.example.com/realms/one/protocol/openid-connect/certs

Usage​

The verifier app retrieves configuration and policy information from /ssi/verifier-provider/v1/{verifierProvider} to enforce version requirements and recommendations.