IO Wallet SDK
    Preparing search index...

    Function verifyClientAttestation

    • Verifies wallet attestation and client attestation PoP headers as a pair.

      Parameters

      • options: VerifyClientAttestationOptions

        Client attestation verification options.

        • authorizationServerMetadata: ItWalletAuthorizationServerMetadata

          The authorization server metadata.

        • callbacks: Pick<CallbackContext, "hash" | "verifyJwt">

          Callbacks for hashing and JWT verification.

        • clientAttestation: ClientAttestationOptions

          The client attestation options.

        • config: IoWalletSdkConfig

          The IT-Wallet SDK configuration, used to select the correct version-specific validation schema for the wallet attestation JWT.

        • OptionaldpopJwkThumbprint?: string

          The DPoP JWK thumbprint value, if DPoP is being used in the request.

        • Optionalnow?: Date

          The current time to use when verifying the JWTs. If not provided current time will be used.

          new Date()
        • OptionalrequestClientId?: string

          The client id provided in the authorization request, if any.

          Pass this when the authorization request includes a client_id parameter. The function will verify that it matches the sub claim in the client attestation JWT. If not provided, no client_id validation is performed.

      Returns Promise<
          {
              clientAttestation: {
                  header: {
                      alg: string;
                      jwk?: {
                          alg?: string;
                          crv?: string;
                          d?: string;
                          dp?: string;
                          dq?: string;
                          e?: string;
                          ext?: boolean;
                          k?: string;
                          key_ops?: string[];
                          kid?: string;
                          kty: string;
                          n?: string;
                          oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
                          p?: string;
                          q?: string;
                          qi?: string;
                          use?: string;
                          x?: string;
                          x5c?: string[];
                          x5t?: string;
                          "x5t#S256"?: string;
                          x5u?: string;
                          y?: string;
                          [key: string]: unknown;
                      };
                      kid?: string;
                      trust_chain: [string, ...string[]];
                      typ: "oauth-client-attestation+jwt";
                      x5c?: string[];
                      [key: string]: unknown;
                  };
                  payload: {
                      aal: string;
                      aud?: string;
                      cnf: {
                          jwk: {
                              alg?: string;
                              crv?: string;
                              d?: string;
                              dp?: string;
                              dq?: string;
                              e?: string;
                              ext?: boolean;
                              k?: string;
                              key_ops?: string[];
                              kid?: string;
                              kty: string;
                              n?: string;
                              oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
                              p?: string;
                              q?: string;
                              qi?: string;
                              use?: string;
                              x?: string;
                              x5c?: string[];
                              x5t?: string;
                              "x5t#S256"?: string;
                              x5u?: string;
                              y?: string;
                              [key: string]: unknown;
                          };
                      };
                      exp: number;
                      iat: number;
                      iss: string;
                      jti?: string;
                      nbf?: number;
                      nonce?: string;
                      status?: Record<string, any>;
                      sub: string;
                      trust_chain?: [string, ...string[]];
                      wallet_link?: string;
                      wallet_name?: string;
                      [key: string]: unknown;
                  };
                  signer: JwtSignerWithJwk;
              };
              clientAttestationPop: {
                  header: {
                      alg: string;
                      jwk?: {
                          alg?: string;
                          crv?: string;
                          d?: string;
                          dp?: string;
                          dq?: string;
                          e?: string;
                          ext?: boolean;
                          k?: string;
                          key_ops?: string[];
                          kid?: string;
                          kty: string;
                          n?: string;
                          oth?: { d?: string; r?: string; t?: string; [key: string]: unknown }[];
                          p?: string;
                          q?: string;
                          qi?: string;
                          use?: string;
                          x?: string;
                          x5c?: string[];
                          x5t?: string;
                          "x5t#S256"?: string;
                          x5u?: string;
                          y?: string;
                          [key: string]: unknown;
                      };
                      kid?: string;
                      trust_chain?: [string, ...string[]];
                      typ: "oauth-client-attestation-pop+jwt";
                      x5c?: string[];
                      [key: string]: unknown;
                  };
                  payload: {
                      aud: string;
                      cnf?: {
                          jkt?: string;
                          jwk?: {
                              alg?: string;
                              crv?: string;
                              d?: string;
                              dp?: string;
                              dq?: string;
                              e?: string;
                              ext?: boolean;
                              k?: string;
                              key_ops?: string[];
                              kid?: string;
                              kty: string;
                              n?: string;
                              oth?: { d?: ...; r?: ...; t?: ...; [key: ...]: ... }[];
                              p?: string;
                              q?: string;
                              qi?: string;
                              use?: string;
                              x?: string;
                              x5c?: string[];
                              x5t?: string;
                              "x5t#S256"?: string;
                              x5u?: string;
                              y?: string;
                              [key: string]: unknown;
                          };
                          [key: string]: unknown;
                      };
                      exp?: number;
                      iat: number;
                      iss: string;
                      jti: string;
                      nbf?: number;
                      nonce?: string;
                      status?: Record<string, any>;
                      trust_chain?: [string, ...string[]];
                      [key: string]: unknown;
                  };
                  signer: JwtSignerWithJwk;
              };
          },
      >

      Verified wallet attestation and client attestation PoP JWT data.

      If required headers are missing or any attestation validation fails.

    Settings

    Member Visibility