API reference

generateDidKey(seed?)

Creates an Ed25519 did:key identity.

function generateDidKey(seed?: Uint8Array): DidKey;

interface DidKey {
  did: string;           // did:key:z6Mk...
  signer: Signer;        // did-jwt signer bound to this key
  privateKey: Uint8Array; // 32-byte seed (keep secret)
  publicKey: Uint8Array;  // 32-byte public key
}

• Pass a 32-byte seed for a deterministic DID (useful in tests or to persist an identity). Omit it for a fresh random identity.
• Throws if seed is not exactly 32 bytes.

Storing an identity: persist the 32-byte privateKey securely (e.g. a KMS or an encrypted secret). Re-create the identity later with generateDidKey(seed).

issueCredential(options)

Signs a W3C Verifiable Credential as an EdDSA JWT and returns the compact JWT string.

function issueCredential(options: IssueOptions): Promise<string>;

interface IssueOptions {
  issuer: DidKey;                    // from generateDidKey()
  subject: string;                   // the holder/subject DID
  claims: Record<string, unknown>;   // goes into credentialSubject
  type?: string[];                   // extra types beyond VerifiableCredential
  expiresIn?: number;                // seconds from now (optional)
}

The subject's id is set automatically from subject. nbf (not-before) is set to now; exp is set when expiresIn is provided.

verifyCredentialJwt(jwt)

Verifies signature and issuer, returning the decoded credential. Throws on an invalid or tampered credential.

function verifyCredentialJwt(jwt: string): Promise<VerifiedCredential>;

Key fields on the result:

• verified: boolean
• issuer: string — the DID that signed the credential
• verifiableCredential — the decoded VC (credentialSubject, type, issuanceDate, expirationDate, …)

Error handling

try {
  const result = await verifyCredentialJwt(jwt);
  // trust result.verifiableCredential.credentialSubject
} catch (err) {
  // invalid signature, expired, or malformed JWT
}