Trusted boundary
Server verifier
Bind each challenge to the trusted deployment origin and gate, then consume challenge and nullifier in one atomic operation.
Verify
The verifier checks schema, challenge digest, expiry, origin, gate, epoch, credential expiry, revocation state, proof validity, and nullifier uniqueness.
ts
import { verifyVeilPassProof } from "@veilpass/server";
const verified = await verifyVeilPassProof({
proofResult,
expectedOrigin: "https://app.example",
expectedGateId: "premium-holder",
});Response minimization
Return the documented success object only. Error responses contain a safe public error code and request ID, never raw verifier diagnostics.