Tessio.Verifier

The .NET / ASP.NET Core verifier for the EU Digital Identity (EUDI) Wallet.

Verify credentials presented by EUDI Wallets directly from your .NET backend, over OpenID4VP 1.0 with SD-JWT VC and mdoc credentials. Native to ASP.NET Core and Azure, with a built-in demo mode so you can run a full verification flow today, before any production wallet ships.

Relying-party (verifier) side only. This library never acts as a wallet or an issuer.

Status: the full pipeline runs on main. The quickstart below works end to end. Mock mode exercises the real protocol path with a built-in wallet, Test mode replays the RFC 9901 conformance vector through the real verifier and Live mode waits for real wallets on the callback endpoint (see the going-live guide). Version 0.3.0 is on NuGet and adds a public verification seam for self-driving and multi-tenant hosts: one process verifies wallet callbacks for many tenants, each against its own request (see the self-driving and multi-tenant guide). SD-JWT VC and mso_mdoc (ISO 18013-5/-7 mobile documents, e.g. the mDL) are verified through the same pipeline, validated against external artifacts at every layer. Follow releases for progress.

Why this exists

The EUDI Wallet arrives under Regulation (EU) 2024/1183: member states must make wallets available by December 2026, and regulated relying parties must accept them by December 2027. The open-source verifier tooling today is Kotlin (walt.id), Rust (SpruceID) and TypeScript (OpenEUDI). If you run on .NET, there hasn't been a native option. This is it.

What you get

• OpenID4VP 1.0 verifier flow (cross-device / QR), DCQL queries, JAR-signed requests (RFC 9101)
• SD-JWT VC verification: issuer signature (JWT VC Issuer Metadata and X.509), selective disclosure, key binding (KB-JWT), transaction data
• mdoc (mso_mdoc) verification: ISO 18013-5/-7 mobile documents like the mDL, validated against the spec's own vectors and an independent implementation
• Token Status List revocation checking
• Demo / Mock / Test / Live modes so you can build before wallets exist, then serve real ones
• Idiomatic ASP.NET Core integration (DI + minimal APIs) and a runnable sample
• Self-driving and multi-tenant hosting: verify wallet callbacks for many tenants in one process, each against its own request (IWalletResponseVerifier)
• A pluggable trust seam (ITrustListResolver) for production trust lists

Install

dotnet add package Tessio.Verifier.AspNetCore

Runs on .NET 8, 9 and 10. The packages target .NET 8 and .NET 10 (both LTS); apps on .NET 9 use the .NET 8 build.

Quickstart in 5 minutes (DEMO mode)

using Tessio.Verifier.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddTessioVerifier(options =>
{
    options.Mode = VerifierMode.Demo;          // auto-completes locally, no real wallet needed
    options.RequestedClaims = ["age_over_18"]; // selective disclosure: ask only for what you need
});

var app = builder.Build();

app.MapTessioVerifier();   // request-init, wallet-callback and result-stream (SSE) endpoints

app.MapGet("/", () => Results.Content(
    """<a href="/verify/start">Start a verification</a>""", "text/html"));

app.Run();

Run it, open the page, start a verification, and DEMO mode returns a verified age_over_18 claim over Server-Sent Events.

Modes

• Demo: auto-completes in seconds, for showcases and first-run experience.
• Mock: a built-in mock wallet posts freshly signed credentials through the full verification pipeline, encrypted responses included. Set options.CredentialFormat = "mso_mdoc" to run the mdoc pipeline instead of SD-JWT VC.
• Test: replays the RFC 9901 conformance vector (the spec's German PID example) through the real verifier, so you see the verifier agree with the specification's own bytes.
• Live: sessions wait for real wallets on the callback endpoint. docs/going-live.md covers the setup: signed requests, trust lists, session stores and response encryption.

Packages

Package	Purpose
Tessio.Verifier.Core	Credential verification (SD-JWT VC, disclosures, KB-JWT). No web dependencies.
Tessio.Verifier.Core.Mdoc	mdoc verification (ISO 18013-5/-7: MSO, digests, device auth).
Tessio.Verifier.OpenId4Vp	OpenID4VP protocol layer (request build, JAR, response parsing, Dcql query builders).
Tessio.Verifier.AspNetCore	DI, endpoints, session management, the multi-tenant verification seam, demo/mock/test modes.
Tessio.Verifier.Trust	ITrustListResolver interface + a basic implementation.

Going to production

docs/going-live.md walks through the code side: signed requests (Key Vault/HSM included), real trust lists, distributed session stores and shared response-encryption keys. For self-driving or multi-tenant hosting (your own store, one process serving many tenants), see docs/self-driving-and-multi-tenant.md. Beyond the code, live verification against real wallets requires a registered Relying Party and a WRPAC (Wallet Relying Party Access Certificate) from a Qualified Trust Service Provider, plus maintained EU trust lists. This library handles the protocol and credential verification. The trust and compliance layer is provided separately (see docs/production.md). Relying parties do not need their own HSM/QSCD, since the QTSP holds those.

Standards

• OpenID4VP 1.0: https://openid.net/specs/openid-4-verifiable-presentations-1_0.html
• SD-JWT VC: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-sd-jwt-vc
• EUDI Architecture & Reference Framework: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework
• WRPAC profile: ETSI TS 119 475

Repository

• Source: https://github.com/tripledownab/tessio-verifier
• Issues: https://github.com/tripledownab/tessio-verifier/issues
• Releases: https://github.com/tripledownab/tessio-verifier/releases

License

Apache-2.0