Verifier Configuration Reference

Every setting the credential verification service accepts. A minimal configuration with only the required settings is in Install the verification service.

server.json

{
  "port": 8081, // (1)!
  "baseUrl": "http://localhost:8081", // (2)!
  "database": { // (3)!
    "persistenceUnitName": "model",
    "driver": "org.postgresql.Driver",
    "url": "jdbc:postgresql://postgres:5432/verifier",
    "user": "postgres",
    "password": "postgres"
  },
  "signing": { // (4)!
    "keyFile": "conf/signing-key/verifier.key",
    "certificateFiles": [
      "conf/signing-key/verifier.pem",
      "conf/signing-key/intermediate.pem"
    ]
  },
  "integrations": { // (5)!
    "authentication": {
      "veUpCKs6U62JYBy9n7v8ZKZUYDIeBCXQ1A8hlR57p4cLKayiAd9nKfI9NXuE9Fna": "Calling application name"
    }
  },
  "clientMetadata": { // (6)!
    "clientName": "Verifier backend name",
    "logoFile": "conf/static/logo.png"
  },
  "sessionCallback": { // (7)!
    "targetUrl": "https://example-application.com/verified-claims",
    "bearerToken": "<a secret your application checks>"
  },
  "issuerTrustAnchors": "conf/issuer-trust-anchors", // (8)!
  "verifierInfo": "conf/verifier-info.json", // (9)!
  "enableAltIdLogger": false // (10)!
}

1. Required. REST endpoint port.
2. Required. The address this service advertises to wallets, used for the authorization request and the presentation submission. Must be reachable by the wallet — see Going to production.
3. Required. PostgreSQL connection. See Database.
4. Required. Signing key and certificate chain, leaf first. This certificate determines the verifier's identity: its hash is the OID4VP client_id. See Signing certificates.
5. API keys for the administrative endpoints. The JSON key is the token, the value a human-readable label. See API keys.
6. Information about this verifier, shown to the holder during consent. See Client metadata.
7. Where verification results are pushed. See Receive verified data.
8. Directory of *.pem root certificates used for PKIX path validation, deciding which issuers this verifier accepts. Optional; omitted, the issuer check does not run. See Issuer trust anchors.
9. Path to a JSON file holding the verifier info list to include in authorization requests. Absent or unparseable, the field is treated as null rather than failing startup.
10. Enables additional identifier logging. Leave false unless asked to enable it for support.

Client metadata

These values improve the holder's experience by giving the wallet something meaningful to show on the consent screen, instead of an opaque identifier.

"clientMetadata": {
  "clientName": "Verifier backend", // (1)!
  "logoFile": "conf/static/partisia-logo.png" // (2)!
}

1. Name of the verifier. This may be presented to the end user.
2. Path to an image file inside the container. It is exposed for wallets to fetch through the service's static endpoint.

Warning

If clientMetadata.logoFile is set, an image must actually exist at that path inside the container. Mount it in — for example ./verifier/conf:/app/conf:ro with the image at verifier/conf/static/partisia-logo.png on the host.

A misspelled setting stops the service

An unrecognized key fails startup and is named in the error, so a typo surfaces immediately rather than silently doing nothing.