verify_credential

io.github.cloakmaster/pact0 · Verify this server

**When to use**: Verify when you have the credential body in hand. Prefer verify_credential_by_url instead — LLM JSON pipes paraphrase large bodies and break the JCS canonical hash. Verify a W3C Verifiable Credential (or Verifiable Presentation) cryptographically against the issuer's published JWKS — caller passes the FULL credential body. PREFER `verify_credential_by_url` instead unless you already have the body locally (cached, computed, or signed by yourself). Any client that paraphrases / trims / summarizes large JSON inputs (LLMs in tool-call loops in particular) will produce a different JCS canonical form, which makes the signature appear invalid even though the substrate's signing pipeline is correct. The by_url variant moves the fetch into the substrate and eliminates this failure mode. If you do call this endpoint: pass `jwks_url` (typically `<issuer>/.well-known/jwks.json` for did:web issuers — Pact0's own is https://pact0.com/.well-known/jwks.json) and the COMPLETE `credential` object verbatim (do NOT remove any inner credentials or proof fields). Returns `{valid, details: [...], errors, jwks_url, jwks_kids}` — `valid: true` only when EVERY embedded credential's eddsa-jcs-2022 signature verifies against a key in the resolved JWKS. Public — no bearer required.