identity.org.au

For services · reference infrastructure

Integration overview

A useful integration needs accepted evidence, a clear request and a verified result. Source code and illustrative messages are starting points, not a production contract.

Begin with the pilot example

The pilot integration page contains a proposed membership data flow and illustrative request/result messages. The interactive demo lets you try consent, refusal and failure outcomes. Neither is a production API or cryptographic verifier.

Define what your service needs

Specify the claim, purpose and assurance. Decide which issuers have authority to make that claim, what evidence they use and how their credentials expire or are revoked. A tier or score alone is not proof of suitability for your decision.

Verify more than a signature

Before accepting a presentation, validate issuer trust, the holder, credential status and time validity. Bind it to your service, current request and fresh challenge. Check the claimed result against the user's approved request. Source-level ZK circuits do not, by themselves, establish this whole chain of trust.

Handle consent and retention

Present who is asking, why, what will be shared and what will be retained. Provide refusal and alternative routes. Withdrawal blocks future use of that consent; previous lawful receipts follow the agreed retention policy. Do not promise that revocation erases every copy.

Select and test the actual interface

Agree the production credential profile and protocol with the issuer and services. Evaluate OpenID4VP and OpenID4VCI where appropriate, then test independent implementations. No conformance or government recognition is established here.

The VEID documentation and source repository provide engineering context. Pin any evaluated version and verify supported behaviour before creating production dependencies.

Review the pilot proposal · Review issuer trust