Verifiable Credential Types

Proof issues the ProofCredentialV1 Verifiable Credential. The authoritative description can be found in the OpenID4VCI issuer metadata at https://api.proof.com/.well-known/openid-credential-issuer.

ProofCredentialV1

The standard Proof identity credential, issued to every verified Holder.

• Format: SD-JWT VC.
• Type identifier (vct): https://credentials.notarize.com/ProofCredentialV1. A stable string, not intended to be dereferenced. Verifiers compare it as an opaque value.
• Signing algorithm: ES256. The credential is signed by an ECDSA P-256 key. Its certificate chain is carried in the x5c header of the issuer-signed JWT and terminates at the Proof Root CA R1. See Proof Certificate Authority.
• Holder key binding: jwk. The Holder's public key is bound into the credential at issuance and used to sign the Key Binding JWT on every presentation.

Claims

ProofCredentialV1 carries the following selectively-disclosable claims. A Verifier requests claims via OID4VP scopes; see Verify a Credential for the scope catalog.

• First Name (given_name): the Holder's given name as it appears on the verified identity document. String.
• Last Name (family_name): the Holder's family name as it appears on the verified identity document. String.
• Date of Birth (birthdate): the Holder's date of birth in ISO 8601 format (YYYY-MM-DD). String.
• Age over 18 (age_equal_or_over.18): a boolean, true if the Holder is 18 or older, false otherwise. Lets a Verifier confirm an age threshold without learning the date of birth.
• Age over 21 (age_equal_or_over.21): a boolean, true if the Holder is 21 or older, false otherwise.
• Age over 65 (age_equal_or_over.65): a boolean, true if the Holder is 65 or older, false otherwise.

All three age_equal_or_over values are always present in the credential; false means the Holder is under that age, not that the age is unknown.

• US Nationality (is_national.us): true when the Holder's verified identity document shows US nationality. Only included when that is the case; it is never issued as false.

If is_national.us is absent, the Holder is either not a US national or their nationality could not be determined from the identity document they verified with. A Verifier must not treat its absence as proof that the Holder is not a US national.

🚧 In development

The following claims are coming to ProofCredentialV1.

• Email (email): the Holder's email address. String.
• Address (address): the Holder's postal address. JSON object.
• Phone Number (phone_number): the Holder's phone number in E.164 format. String.
• Identity Assurance Level (ial): the assurance level the credential was issued at. String.
• Authenticator Assurance Level (aal): the authenticator assurance level used at presentation time. String.
• Sanction Screening (sanction_screening): the result of sanction screening performed on the Holder. JSON object.

💡Additional Claims

Decoded sample

For the structure of the SD-JWT VC issued for ProofCredentialV1 (issuer-signed JWT, disclosures, Key Binding JWT), see SD-JWT VC Format.

See also: SD-JWT VC Format · Verify a Credential · Proof Certificate Authority