> ## Documentation Index
> Fetch the complete documentation index at: https://docs.air3.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How credential verification works

> How an app checks an AIR credential: the verification program, the user's consent, the presentation, and the backend check that makes it trustworthy.

Verification lets an app check a fact about a user, such as "holds a Gold membership", without seeing anything else. The user's device finds the matching credential, the user approves what is shared, and the app receives a **presentation**: the approved claims, still carrying the issuer's signature. The app's backend checks that signature before acting on it.

## The verification program decides what to check

Apps do not describe the check in code. They pass a **program ID**, and the verification program configured in the Developer Dashboard defines:

| Setting | Example |
| - | - |
| Credential type and format | Membership credentials in the default SD-JWT format |
| Conditions | Tier must be Gold |
| Claims to share | Only the tier, not name or points |
| Trusted issuers (optional) | Only credentials from a specific issuer DID |
| Revocation check | Ask the issuer whether the credential was revoked |

Changing what you require is a Dashboard change, not a code deploy.

## The flow

```mermaid theme={null}
sequenceDiagram
    participant App as Your app
    participant Kit as AIR Kit
    actor User
    participant Backend as Your backend

    App->>Backend: Start verification
    Backend-->>App: One-time challenge
    App->>Kit: Verify with program + challenge
    Kit->>Kit: Find and decrypt the credential
    Kit->>User: Show what will be shared
    User->>Kit: Approve
    Kit-->>App: Presentation
    App->>Backend: Presentation
    Backend->>Backend: Check, then grant or deny
```

1. **Challenge.** Your backend creates a one-time random challenge (a nonce) for this attempt.
2. **Find and decrypt.** AIR Kit finds the user's matching credential in encrypted storage and decrypts it on the user's device. AIR only handles ciphertext.
3. **Consent.** The user sees exactly which claims will be shared. If they decline, nothing is shared.
4. **Present.** AIR Kit builds the presentation: the issuer-signed credential with only the approved claims, plus the user's signature over your challenge.
5. **Check.** AIR Kit checks the presentation in the browser for a quick answer. Your backend then checks it properly before granting anything.

> [!WARNING]
>
> The browser's `Compliant` result is not proof to your backend; it is not signed. Only the presentation is. See [Checking a presentation](https://docs.air3.com/technicals/architecture/how-credential-verification-works/backend-checks.md).

## Ways to verify

| Where verification runs | Use it when | Read more |
| - | - | - |
| **In your app, with AIR Kit** | The user is present in your web or mobile app | This section |
| **On a server, by an agent** | An AI agent acts for the user, with the user's prior approval | [How agentic commerce works](https://docs.air3.com/technicals/architecture/how-agentic-commerce-works.md) |
| **With a zero-knowledge proof** | You need to prove a condition without revealing the value, or verify on-chain | [Zero-knowledge verification](https://docs.air3.com/technicals/architecture/how-credential-verification-works/zero-knowledge.md) |

## In this section

> **[What the verifier receives](https://docs.air3.com/technicals/architecture/how-credential-verification-works/presentation.md)**
>
> The parts of a presentation and what each one proves.

> **[Checking a presentation](https://docs.air3.com/technicals/architecture/how-credential-verification-works/backend-checks.md)**
>
> What your backend checks, and why.

> **[Results and errors](https://docs.air3.com/technicals/architecture/how-credential-verification-works/results.md)**
>
> Every outcome and how to handle it.

> **[Zero-knowledge verification](https://docs.air3.com/technicals/architecture/how-credential-verification-works/zero-knowledge.md)**
>
> Proving conditions with Iden3 credentials.

To build a verifier, follow the developer guide: [Verifying credentials](https://docs.air3.com/products/identity/verify).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.