multipaz/org.multipaz.sdjwt/SdJwtKb/verify

verify

suspend fun verify(issuerKey: PublicKey? = null, checkNonce: (nonce: String) -> Boolean = { true }, checkAudience: (audience: String) -> Boolean = { true }, checkCreationTime: (creationTime: Instant) -> Boolean = { true }, transactionData: List<TransactionData<*>> = listOf()): JsonObject

Verifies a SD-JWT+KB according to Section 7.3 of the SD-JWT specification.

Note that per Section 7.3 of RFC 9901, the returned JSON object is the Processed SD-JWT Payload containing only the Issuer-signed claims (with Disclosures resolved). The device-signed claims in the Key Binding JWT (such as nonce, aud, iat, and any transaction response claims) are not included in this returned payload and must be retrieved separately from jwtBody.

Return

the processed SD-JWT payload.

Parameters

issuerKey

the issuer's key to use for verification or null to not perform issuer signature validation.

checkNonce

a function to check that the nonce in the KB JWT is as expected.

checkAudience

a function to check that the audience in the KB JWT is as expected.

checkCreationTime

a function to check that the creation time in the KB JWT is as expected.

transactionData

transaction data that was sent with the request.

Throws

if the issuer signature or key-binding signature failed to validate.

Generated by Dokka
© 2026 Copyright