For developers

A proof is a signed statement you can check yourself. Nothing here requires permission, an API key, or trusting IRLProof's website.

The shape of a proof

Every proof has a short link, https://sandbox.irlproof.me/<jti>. Ask for JSON and you get the signed token plus its live status:

curl -H 'Accept: application/json' https://sandbox.irlproof.me/x7k2m9p4qw

{
  "jti": "x7k2m9p4qw",
  "token": "eyJhbGciOiJFUzI1NiJ9.<payload>.<signature>",
  "status": { "jti": "x7k2m9p4qw", "status": "active", "checked_at": 1788480202 }
}

Two questions, deliberately separate

Is the signature genuine? Pure maths against a published key. Answerable offline, forever, by anyone. Is it still active? A live fact, because a proof can be revoked after it was signed. That one needs a network call.

This is why revocation is not inside the signed payload, and why a page never merges the two into a single checkmark. A revoked proof still has a perfectly valid signature. If revocation matters to you, you must check status; if you only need to know the issuer really signed this, you never have to talk to us again.

Verifying offline

Fetch the keys once from /.well-known/irlproof/jwks.json and the issuer metadata from /.well-known/irlproof/issuer.json.
Split the token on dots. The middle part is base64url JSON; decode and read it.
Check the ES256 (ECDSA P-256, SHA-256) signature over header.payload using the key whose kid matches the token header.
Check iss is the issuer you expect, and that now is before exp. Both iat and exp are truncated to a whole day on purpose, so two proofs cannot be correlated by their timestamps.
Reject any payload member you do not recognise. The format says so, and it keeps forgeries from smuggling fields past you.

That is the entire offline check. It is short enough to implement in any language in an afternoon, which is the point: nobody should have to take our word for the format.

What a proof does and does not say

It says: a real person, holding a government-issued mobile driver's license, asked IRLProof to record that they hold a stated account on a stated platform, at a stated time.

It does not say that person controls the account. IRLProof never logs into anything. Control is demonstrated by the account itself publishing the link. If you are building on this, that distinction is the one to get right: a proof found anywhere other than the named account proves nothing about that account.

Status values

Value	Meaning
active	Signed, unexpired, not revoked.
expired	Past its exp. The signature is still genuine.
revoked	Withdrawn by the holder or by deletion. The signature is still genuine.
unknown	No such proof id at this issuer.

Revoked proofs are kept deliberately. If the record were deleted, the link would 404, and a verifier could not tell "revoked" from "never existed" or "their site is down". Retention is what lets revocation mean anything.

Rate limits and etiquette

The JSON endpoint is open for GET from any origin. Please cache the JWKS rather than fetching it per verification, and check status no more often than your use actually needs.

This is a test deployment. Its issuer id is https://sandbox.irlproof.me and every proof it signs carries "test": true. Do not trust these as real, and do not add this issuer to a production trust list.

This page grows as more is exposed. How it works · Why it exists