FAQ & troubleshooting

Is this production-ready SSI?

It's a learning-grade, offline foundation. did:key has no revocation or key rotation, so for production (wallets, revocation, exchange protocols) graduate to a full stack — see Going to production.

Why did:key instead of did:web or a ledger?

Because the public key is embedded in the identifier, a verifier resolves it offline — no registry, no network. That's the simplest possible way to understand issue/verify.

verifyCredentialJwt throws instead of returning false

That's by design: an invalid signature, an expired credential, or a malformed JWT throws. Wrap it in try/catch.

Can I persist an identity?

Yes — store the 32-byte privateKey from generateDidKey() securely and re-create the same DID later with generateDidKey(seed).

JWT or JSON-LD proofs?

This library uses JWT (JWS/EdDSA) VCs — compact and interoperable with the JOSE ecosystem. JSON-LD Data Integrity proofs are equally valid W3C VCs but more involved.

Does it work in the browser?

The crypto (@noble/curves) is isomorphic, but did-jwt/resolvers target Node; test your target runtime. For browser wallets, a full SSI SDK is usually a better fit.