> ## Documentation Index
> Fetch the complete documentation index at: https://docs.air3.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity & Credential

> Troubleshoot AIR Identity and AIR Credential flows — issuance, verification, and schema problems, and resolve program configuration errors.

Troubleshooting for AIR Identity and AIR Credential flows: issuance, verification, and schema configuration. For API status codes and SDK error names, see [Error codes](/help/error-codes).

## Issuance

### On-demand issuance credential not stored (no storagePath)

`POST /dstorage/vcs` stores an encrypted credential and returns a `storagePath`. Issuer-hosted `POST /issue-vc` performs this upload internally and returns an empty response body. Issuance typically completes in \~1–4 seconds.

* If `POST /dstorage/vcs` did not return a `storagePath`, retry with exponential backoff (start at 1 second, double each attempt, cap at 30 seconds).
* Check DStorage endpoint configuration and that your Partner JWT is valid.
* Do not rebuild and re-issue on every transient failure — retry the store step with the same encrypted payload fields.

### Issuance returns 400

* Verify `holderDid`, `schemaId`, `expiresAt`, `data`, `iv`, `authTag`, `encryptedKey`, and `externalId` are all present and correctly typed.
* Ensure the credential data matches the schema definition exactly. Extra fields or wrong types will be rejected.
* Check the response body for a specific error message.

### Issuance returns 409

This usually means:

* **User consent rejected:** The user has previously declined credentials from your partner account. Contact the user or wait for them to re-consent.
* **Duplicate credential:** A credential already exists for this user + schema combination. Dedupe by recipient email + program ID, and revoke the existing credential before reissuing if the data changed.

### Credential not visible to user after issuance

* For on-demand issuance, confirm `POST /dstorage/vcs` returned a `storagePath`. When your backend calls `POST /issue-vc`, confirm it succeeded and inspect the issuer's issuance record for its DStorage result.
* For on-demand issuance, newly created users see issued credentials when they first log in. They may be prompted to accept or reject credentials.
* Verify the `initialize-user` request body contains the intended recipient's email; on-demand issuance Partner JWTs do not carry the recipient email.

## Verification

### Verification returns "no matching credential"

* The user may not have a credential matching the verification program's schema. Check that:
  * The credential was issued using the correct issuance program.
  * The credential has not been revoked.
  * The verification program's schema matches the issuance program's schema.

### Verification fails with "proof invalid"

* The issuer signature doesn't match the key published in the issuer's `did:web` DID document. Check that the issuer hasn't removed the key it signed with.
* The key-binding JWT doesn't match your `nonce`. Create a fresh nonce for each verification and use it only once.
* The credential has expired or been revoked.
* If the credential was just issued, make sure the store step returned a `storagePath` before you verify.

For the full set of backend checks, see [Verify SD-JWT on your backend](/products/identity/verify-sd-jwt).

### User declines verification

* The SDK prompts users for consent before presenting a credential. If the user declines, the verification result will indicate failure.
* Your app should handle this gracefully — show a message explaining why the credential is needed and offer to retry.

## Schema issues

### "Schema not found" error

* Verify the schema exists in the Developer Dashboard (Issuer > Schemas).
* Ensure the `credentialId` (Issuance Program ID) references a published program, not a draft.

### Schema mismatch between issuance and verification

* If a verification program rejects credentials that were successfully issued, the issuance and verification programs may reference different schema versions.
* Check both programs in the Developer Dashboard and ensure they point to the same schema.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.