Quickstart: Verifying your first credential

import { createRemoteJWKSet, jwtVerify } from "jose";

// Sandbox AIR login keys, tried in order. Production uses only
// https://static.air3.com/.well-known/jwks.json.
const AIR_JWKS = [
  "https://static.sandbox.air3.com/.well-known/jwks.json",
  "https://account.sandbox-testnet.air3.com/.well-known/jwks.json",
  "https://static.air3.com/.well-known/jwks.json",
].map((url) => createRemoteJWKSet(new URL(url)));

// Returns the AIR user ID (`sub`) from a valid AIR login token, or null.
export async function getAirUserId(request: Request): Promise<string | null> {
  const header = request.headers.get("authorization") ?? "";
  const token = /^Bearer\s+(\S+)$/i.exec(header)?.[1];
  if (!token) return null;
  for (const keys of AIR_JWKS) {
    try {
      const { payload } = await jwtVerify(token, keys);
      if (payload.partnerId !== process.env.NEXT_PUBLIC_PARTNER_ID) return null;
      return typeof payload.sub === "string" && payload.sub ? payload.sub : null;
    } catch (error) {
      if ((error as { code?: string }).code === "ERR_JWKS_NO_MATCHING_KEY") continue;
      return null;
    }
  }
  return null;
}

// One pending nonce per user, valid for 5 minutes. This in-memory map serves a
// single server process; use your session store or database otherwise.
type Pending = Map<string, { nonce: string; expires: number }>;
const pending: Pending = ((globalThis as { airNonces?: Pending }).airNonces ??= new Map());

export function saveNonce(userId: string, nonce: string) {
  pending.set(userId, { nonce, expires: Date.now() + 5 * 60_000 });
}

// Returns the user's pending nonce and deletes it, so it is checked only once.
export function takeNonce(userId: string): string | null {
  const entry = pending.get(userId);
  pending.delete(userId);
  return entry && entry.expires > Date.now() ? entry.nonce : null;
}

import { randomBytes } from "node:crypto";
import { NextResponse } from "next/server";
import { importPKCS8, SignJWT } from "jose";
import { getAirUserId, saveNonce } from "@/lib/air-session";

export async function POST(request: Request) {
  const userId = await getAirUserId(request);
  if (!userId) {
    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
  }

  const partnerId = process.env.NEXT_PUBLIC_PARTNER_ID;
  const privateKeyBody = process.env.PARTNER_PRIVATE_KEY;

  if (!partnerId || !privateKeyBody) {
    return NextResponse.json(
      { error: "Missing Partner JWT configuration" },
      { status: 500 },
    );
  }

  try {
    const pem = privateKeyBody.includes("BEGIN PRIVATE KEY")
      ? privateKeyBody
      : `-----BEGIN PRIVATE KEY-----\n${privateKeyBody.trim()}\n-----END PRIVATE KEY-----`;
    const alg = process.env.SIGNING_ALGORITHM ?? "RS256";
    const key = await importPKCS8(pem, alg);
    const token = await new SignJWT({ partnerId, scope: "verify" })
      .setProtectedHeader({ alg, kid: partnerId, typ: "JWT" })
      .setIssuedAt()
      .setExpirationTime("5m")
      .sign(key);

    // One-time nonce for the key-binding JWT, stored for this user.
    // /api/verify-presentation checks it and deletes it.
    const nonce = randomBytes(16).toString("base64url");
    saveNonce(userId, nonce);

    return NextResponse.json({ token, nonce });
  } catch {
    return NextResponse.json(
      { error: "Unable to sign verification token" },
      { status: 500 },
    );
  }
}

import { AirService, BUILD_ENV } from "@mocanetwork/airkit";

let servicePromise: Promise<AirService> | undefined;

function getAirService(): Promise<AirService> {
  servicePromise ??= (async () => {
    const partnerId = process.env.NEXT_PUBLIC_PARTNER_ID;
    if (!partnerId) throw new Error("Partner ID is required");

    const service = new AirService({ partnerId });
    await service.init({ buildEnv: BUILD_ENV.SANDBOX });
    return service;
  })().catch((error) => {
    servicePromise = undefined;
    throw error;
  });
  return servicePromise;
}

export async function verifyCredential() {
  const programId = process.env.NEXT_PUBLIC_VERIFY_PROGRAM_ID;
  if (!programId) throw new Error("Verification program ID is required");

  const service = await getAirService();
  if (!service.isLoggedIn) await service.login();

  // Your server returns a Partner JWT and a fresh nonce stored for this user.
  // The AIR login token tells it who the user is.
  const response = await fetch("/api/verification-token", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      authorization: `Bearer ${(await service.getAccessToken()).token}`,
    },
  });
  const body = (await response.json()) as {
    token?: string;
    nonce?: string;
    error?: string;
  };
  if (!response.ok || !body.token || !body.nonce) {
    throw new Error(body.error ?? "Unable to obtain verification token");
  }

  const result = await service.verifyCredential({
    authToken: body.token,
    programId,
    fieldsToDisclose: ["historical_amount"], // or "*" for every field
    nonce: body.nonce,
  });
  if (result.status !== "Compliant") return { status: result.status, verified: false };

  // AIR's check ran in this browser. Only your backend's answer counts.
  const check = await fetch("/api/verify-presentation", {
    method: "POST",
    headers: {
      "content-type": "application/json",
      // Fetch the token again: the consent screen may have taken time
      authorization: `Bearer ${(await service.getAccessToken()).token}`,
    },
    body: JSON.stringify({ verifiablePresentation: result.verifiablePresentation }),
  });
  const verdict = (await check.json().catch(() => null)) as {
    verified?: boolean;
    claims?: Record<string, unknown>;
  } | null;
  return {
    status: result.status,
    verified: check.ok && verdict?.verified === true,
    claims: verdict?.claims,
  };
}

import { NextResponse } from "next/server";
import { getAirUserId, takeNonce } from "@/lib/air-session";
import { verifyAirSdJwt } from "@/lib/verify-air-sd-jwt";

export async function POST(request: Request) {
  const userId = await getAirUserId(request);
  if (!userId) {
    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
  }

  // Take the nonce before verifying: it is single-use even if verification fails
  const expectedNonce = takeNonce(userId);
  if (!expectedNonce) {
    return NextResponse.json({ error: "No pending verification" }, { status: 400 });
  }

  const body = await request.json().catch(() => null);
  try {
    const { claims } = await verifyAirSdJwt({
      verifiablePresentation: body?.verifiablePresentation ?? {},
      programId: process.env.NEXT_PUBLIC_VERIFY_PROGRAM_ID!,
      expectedNonce,
      requireHolderBinding: true,
      trustedIssuers: (process.env.AIR_TRUSTED_ISSUERS ?? "")
        .split(",")
        .map((iss) => ({ iss: iss.trim() as `did:web:${string}` })),
      expectedVct: process.env.AIR_EXPECTED_VCT!,
      requiredClaims: ["historical_amount"], // your fieldsToDisclose
    });
    // Grant access or record the result here, based on the verified claims
    return NextResponse.json({ verified: true, claims: { historical_amount: claims.historical_amount } });
  } catch {
    return NextResponse.json({ verified: false }, { status: 422 });
  }
}