x401

npm install express @proof.com/x401-node @proof.com/proof-vc-server

openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem

import express from "express";
import { readFileSync } from "node:fs";
import { createPrivateKey, createPublicKey } from "node:crypto";
import { agentsTrustListUrl, createClientIdMetadataDocument } from "@proof.com/proof-vc-server";

// Your domain host
const domain = "";
// The exact URL at which the Client ID Metadata Document is hosted.
const CLIENT_ID = `https://${domain}/.well-known/proof-client.json`;
const privateKey = createPrivateKey(readFileSync("private-key.pem"));
const publicJwk = createPublicKey(privateKey).export({ format: "jwk" });
// "sandbox" for testing, "production" for production.
const environment = "sandbox";

const app = express();

const document = await createClientIdMetadataDocument({
  environment,
  clientId: CLIENT_ID,
  // Your business name, shown to users when they approve
  // a credential presentation for your endpoints.
  clientName: "Acme Corporation",
  // The agents allowed to use x401 with Proof's Cloud Wallet at your endpoints:
  // your own agents (by URL) or Proof's trusted list with `agentsTrustListUrl`.
  redirectUris: [agentsTrustListUrl(environment)],
  jwks: [publicJwk],
});

app.get("/.well-known/proof-client.json", (req, res) => {
  res.json(document);
});

export { app, CLIENT_ID };

npx @proof.com/proof-vc-server enroll https://example.com/.well-known/proof-client.json --email [email protected] --key private-key.pem --environment sandbox

import { app, CLIENT_ID } from "./client-metadata.mjs";
import { readFileSync } from "node:fs";
import { createPrivateKey, randomUUID } from "node:crypto";
import { verifier as x401, HEADER, DC_API_PROTOCOL } from "@proof.com/x401-node";
import { agentsTrustListUrl, createClient, createVerifier } from "@proof.com/proof-vc-server";

const privateKey = createPrivateKey(readFileSync("private-key.pem"));
const environment = "sandbox";

const proofClient = createClient({
  environment,
  clientId: CLIENT_ID,
  // Signs your OID4VP requests.
  useSecuredAuthorizationRequest: true,
  privateKeyFactory: () => privateKey,
});
const proofVerifier = createVerifier({
  environment,
  clientId: CLIENT_ID,
  // Fetches the detached signatures of the vp_token from Proof. See step 6.
  privateKeyFactory: () => privateKey,
});
// Nonces of pending OID4VP requests. Use a shared store in production.
const nonces = new Set();

async function x401Middleware(req, res, next) {
  const response = req.get(HEADER.PROOF_RESPONSE);

  if (response === undefined) {
    // Prevents replay attacks: each nonce is accepted once.
    const nonce = randomUUID();
    nonces.add(nonce);
    // A signed OID4VP request over the Digital Credentials API.
    const request = await proofClient.signedDcApiRequest({
      // See https://dev.proof.com/docs/verify-a-credential#scopes-and-claims
      scope: "urn:proof:params:scope:verifiable-credentials:basic",
      nonce,
      // A subset of the redirectUris of your CIMD.
      expectedOrigins: [agentsTrustListUrl(environment)],
    });
    // The PROOF-REQUEST header, following the x401 protocol.
    const payload = x401.buildPayload({
      credentialRequirements: {
        digital: {
          requests: [{ protocol: DC_API_PROTOCOL.SIGNED, data: { request } }],
        },
      },
    });
    return res
      .status(401)
      .set(HEADER.PROOF_REQUEST, x401.encodePayload(payload))
      .send("x401 PROOF-RESPONSE required");
  }

  try {
    const artifact = x401.decodeResultArtifact(response);
    // The credential result is inline, or behind a URL your endpoint fetches.
    let credentialResult = null;
    if (artifact.credential_result_uri === undefined) {
      credentialResult = artifact.credential_result;
    } else {
      const response = await fetch(artifact.credential_result_uri);
      credentialResult = await response.json();
    }
    // Verifies the vp_token, issued by Proof's Certificate Authority.
    // See https://dev.proof.com/docs/proof-certificate-authority
    const presentation = await proofVerifier.verifyVPToken({
      encodedVPToken: credentialResult.data.vp_token,
      aud: CLIENT_ID,
    });
    req.credential = presentation.proof_id_default[0];
    if (!nonces.delete(req.credential.getNonce())) {
      return res.status(401).send("x401 PROOF-RESPONSE replayed");
    }
  } catch {
    return res.status(401).send("x401 PROOF-RESPONSE invalid");
  }
  next();
}

app.get("/protected", x401Middleware, (req, res) => {
  // Reachable by user agents presenting a valid Verifiable Credential.
  res.json({ message: "Access granted", claims: req.credential.toJSON() });
});

app.listen(3000);

npm install @x402/fetch @x402/evm viem

import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
import { ExactEvmScheme } from "@x402/evm";
import { privateKeyToAccount } from "viem/accounts";

// Your wallet, funded with USDC on Base (Base Sepolia in sandbox).
const wallet = privateKeyToAccount(process.env.EVM_PRIVATE_KEY);

// Replaces proofVerifier from step 5.
const proofVerifier = createVerifier({
  environment,
  clientId: CLIENT_ID,
  privateKeyFactory: () => privateKey,
  // Pays 402 Payment Required responses with x402.
  fetch: wrapFetchWithPaymentFromConfig(fetch, {
    schemes: [{ network: "eip155:*", client: new ExactEvmScheme(wallet) }],
  }),
});

curl -so /dev/null -w '%header{proof-request}' https://example.com/protected \
  | jq -R 'gsub("-";"+") | gsub("_";"/") | @base64d | fromjson'

curl -so /dev/null -w '%header{proof-request}' https://example.com/protected \
  | jq -R 'gsub("-";"+") | gsub("_";"/") | @base64d | fromjson
    | .credential_requirements.digital.requests[0].data.request
    | split(".")[1] | gsub("-";"+") | gsub("_";"/") | @base64d | fromjson'

npx @proof.com/proof-vc-server enroll https://example.com/.well-known/proof-client.json --email [email protected] --key private-key.pem

npm install @proof.com/x401-workers

import { Hono } from "hono";
import { agentsTrustListUrl, d1NonceStore } from "@proof.com/x401-workers";
import { x401, type X401Variables } from "@proof.com/x401-workers/hono";

type Env = { DB: D1Database; SIGNING_JWK: string };

const app = new Hono<{ Bindings: Env; Variables: X401Variables }>();

// Every route under /protected now requires a Verifiable Credential.
app.use(
  "/protected/*",
  x401<{ Bindings: Env }>((c) => ({
    clientId: CLIENT_ID,
    privateKeyFactory: () => JSON.parse(c.env.SIGNING_JWK),
    nonceStore: d1NonceStore(c.env.DB),
    scope: "urn:proof:params:scope:verifiable-credentials:basic",
    expectedOrigins: [agentsTrustListUrl(environment)],
  })),
);

app.get("/protected", (c) => c.json(c.var.x401.proof_id_default[0]?.toJSON()));

export default app;