EU Digital Identity Wallet · .NET
Verify EUDI Wallet credentials
from your .NET backend.
Open-source ASP.NET Core verifier for OpenID4VP 1.0 +SD-JWT VC, including mdoc (mDL) verification. Native DI wiring, demo mode included and a clean trust seam for when you go to production.
Install
$ dotnet add package Tessio.Verifier.AspNetCoreFive-minute quickstart
Wire one ASP.NET Core endpoint, run it and watch a verified age_over_18claim come back over Server-Sent Events. No production wallet required.
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddTessioVerifier(options =>
{
options.Mode = VerifierMode.Demo; // local-only flow, no real wallet needed
options.RequestedClaims = ["age_over_18"]; // selective disclosure: ask only for what you need
});
var app = builder.Build();
app.MapTessioVerifier(); // request-init, wallet-callback, result-stream
app.MapGet("/", () => Results.Content(
"""<a href="/verify/start">Start a verification</a>""", "text/html"));
app.Run();Why a .NET-native verifier?
Native to .NET
Runs on .NET 8, 9 and 10. DI extensions, minimal APIs, Azure-friendly. No translation from Kotlin or Rust, the code looks like the rest of your stack.
Demo mode included
No production wallets yet? Demo auto-completes locally, Mock issues real signed credentials through the whole pipeline, Test replays the RFC 9901 spec vector and Live waits for real wallets.
HAIP-aligned
OpenID4VP 1.0, SD-JWT VC with `dc+sd-jwt`, mdoc (mDL), DCQL queries, JAR-signed requests, encrypted responses. Built to the EUDI profile that matters.
Pluggable trust
Trust is a seam, not a hardcode. `ITrustListResolver` already backs a dev resolver, pinned anchors, and a refreshing reader for the live EU age verification trusted list. The national issuer lists are not published yet; when they are, it is a swap behind the same API.
Status
v0.9.1 is on NuGet, and it passes the OIDF HAIP plans in both formats
Install the package and the quickstart above runs end to end. Both OpenID Foundation HAIP verifier plans pass on this release, SD-JWT VC and ISO mdoc, run against the Foundation's own conformance suite rather than our tests. The SD-JWT VC core passes the RFC 9901 spec vectors, the mdoc pipeline agrees byte for byte with the ISO 18013-5 worked example, and Test mode replays each specification's own example through the real verifier. Live mode serves real wallets with signed requests, encrypted responses and a QR start page; the going-live guide covers the path there. Both verification pipelines are fuzz-tested, and a public verification seam lets one process verify wallet callbacks for many tenants, each against its own request. The public API stays frozen atcontracts-v0.
Mandatory acceptance under Regulation (EU) 2024/1183 lands 24 December 2027, for private relying parties in the eleven sectors Article 5f(2) names, and only when a user asks. We're shipping this before then so .NET shops aren't left translating from Kotlin.
Built on the standards
No proprietary protocols. The credentials Tessio verifies are the same ones every EUDI Wallet emits.