Authentication Playground

Declare exactly which credential fields you need with a W3C Presentation Definition:

<script type="module">
  import { HessKeyAuth }
    from 'https://your-verifier.com/shared/hesskey-sdk.js';

  const auth = new HessKeyAuth({
    verifierApiUrl: 'https://your-verifier.com',
    domain: window.location.hostname,
    authType: 'siop_vp',
    presentationDefinition: {
      id: 'login',
      inputDescriptors: [{
        id: 'identity',
        name: 'Identity Credential',
        constraints: {
          fields: [
            { path: ['$.credentialSubject.givenName'] },
            { path: ['$.credentialSubject.familyName'] },
            { path: ['$.credentialSubject.nationality'] },
          ],
        },
      }],
    },
  });

  document.getElementById('signin').onclick = async () => {
    await auth.createSession();
    auth.renderQR(document.getElementById('qr'), { size: 256 });

    auth.onVerified((result) => {
      const vp = result.result.vp;
      const cred = vp.verifiableCredential[0];
      console.log('Hello', cred.credentialSubject.givenName);
    });
  };
</script>

What the verifier checks automatically:

• VC issuer is a trusted CSCA (passive authentication chain)
• VC signature (eddsa-jcs-2022) is valid against the holder's on-chain DID
• id_token (SIOP JWT) nonce matches the session
• VP is bound to your client_id — cannot be replayed elsewhere

Request predicates and encrypted fields. The verifier decrypts with its X25519 private key server-side:

<script type="module">
  import { HessKeyAuth }
    from 'https://your-verifier.com/shared/hesskey-sdk.js';

  const auth = new HessKeyAuth({
    verifierApiUrl: 'https://your-verifier.com',
    domain: window.location.hostname,
    authType: 'bbs_ecdh',
    predicates: [
      {
        fieldPath: '$.credentialSubject.dateOfBirth',
        predicate: 'AGE_OVER',
        value: 18,
        verifierDid: 'did:hesskey:your-verifier',
      },
    ],
    encryptedFields: ['given_name', 'family_name'],
    presentationDefinition: {
      id: 'kyc',
      inputDescriptors: [{
        id: 'identity-bbs',
        constraints: {
          fields: [
            { path: ['$.credentialSubject.dateOfBirth'] },
            { path: ['$.credentialSubject.givenName'] },
            { path: ['$.credentialSubject.familyName'] },
          ],
        },
      }],
    },
  });

  document.getElementById('signin').onclick = async () => {
    await auth.createSession();
    auth.renderQR(document.getElementById('qr'), { size: 256 });

    auth.onVerified((result) => {
      // ZKP proofs verified on-chain by the verifier
      console.log('Predicates:', result.result.predicates);
      // Encrypted claims decrypted server-side
      console.log('Claims:', result.result.encryptedClaims);
    });
  };
</script>

Server-side prerequisites:

• Register your verifier DID on-chain with an X25519 key-agreement key
• Keep the X25519 private key on the server — never ship it to the browser
• Cryptographic erasure: call revoke_claim_access on-chain to make stored ciphertext for that user permanently unreadable

For direct Web Bluetooth, call navigator.bluetooth.requestDevice() in the click handler (before any await) to preserve the user gesture, then write the auth URI over GATT:

<script type="module">
  import { HessKeyAuth, isExtensionPaired }
    from 'https://your-verifier.com/shared/hesskey-sdk.js';

  const BLE_SERVICE = 'ae55be01-c0de-e5c1-b1e1-000000000001';
  const BLE_AUTH    = 'ae55be01-c0de-e5c1-b1e1-000000000010';

  document.getElementById('signin').onclick = async () => {
    // 1. Request device BEFORE any await (user gesture)
    let device = null;
    if ('bluetooth' in navigator && !isExtensionPaired()) {
      device = await navigator.bluetooth.requestDevice({
        filters: [{ services: [BLE_SERVICE] }],
      });
    }

    // 2. Create session (SDK starts polling automatically)
    const auth = new HessKeyAuth({
      verifierApiUrl: 'https://your-verifier.com',
      domain: window.location.hostname,
      authType: 'siop_vp',
      presentationDefinition: { /* ... */ },
    });
    const session = await auth.createSession();

    // 3. Write auth URI over BLE GATT
    if (device) {
      const server = await device.gatt.connect();
      const svc  = await server.getPrimaryService(BLE_SERVICE);
      const char = await svc.getCharacteristic(BLE_AUTH);
      const bytes = new TextEncoder().encode(session.qrPayload);
      await char.writeValueWithResponse(bytes);
      server.disconnect();
    }
    // If extension is paired, it delivers automatically.

    // 4. Wait for result (polling picks up the phone's VP POST)
    auth.onVerified((result) => {
      console.log('Signed in as', result.result.did);
    });
  };
</script>

Requirements:

• Direct BLE: Page must be served over HTTPS (Web Bluetooth requires a secure context). Works in Chrome and Edge.
• Extension bridge: The Hesskey Chrome extension must be installed and paired with the phone. No HTTPS requirement for the extension path.
• No server-side changes — the verifier sees a standard SIOP session regardless of transport