Blog ← How to verify a JIAOZI credential without JIAOZI

How to verify a JIAOZI credential without JIAOZI

2026-08-29

There is a litmus test for whether an identity system is truly open: can the credential still be verified without the issuer? If verification must go through our website, our API, our approval, then "open" is just a word. For JIAOZI credentials the answer is yes — here is why, and how.

Why you don't need us

JIAOZI credentials follow the W3C Verifiable Credentials standard, signed with Ed25519 — a public algorithm implemented by every mainstream open-source crypto library. Any standards-compliant tool, written by anyone, plus the published public key, verifies the credential entirely on your own machine. The process never touches our servers; our being offline changes nothing.

Four steps

• Fetch the credential. Call GET /api/vc/{credentialId}, or have the agent present the copy it carries.
• Fetch the public key. The credential names the issuer's DID; per the did:web rules, fetch the DID document at /.well-known/did.json under the issuer's domain. The live-status signing key has its own endpoint, /api/status-key.
• Verify the signature. Hand credential and key to any standard verification library. Math decides: a valid signature proves the content is untampered and originates from the key holder.
• Check revocation. Credentials can be revoked or expire. The W3C Bitstring Status List — a public revocation list in a standard format — tells you whether this credential is currently valid.

In pseudocode (a sketch, not runnable code):

vc     = GET /api/vc/{credentialId}    # 1. fetch credential
didDoc = GET /.well-known/did.json     # 2. fetch public key
verify(vc, didDoc.publicKey)           # 3. any standard library
checkStatus(vc)                        # 4. check revocation

What this means for you

Verification needs no signup, no payment, no dependency on us. You can build this logic into your own systems and run it for years without lock-in. That is not generosity; it is design: an identity system deserves trust only when its issuer is not also the referee.

This service provides technical identity verification and does not constitute electronic certification under the PRC Electronic Signature Law.