> For the complete documentation index, see [llms.txt](https://docs.zetrix.com/oid4vp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zetrix.com/oid4vp/overview.md).

# Overview

**Version:** 1.0\
**Last Updated:** 2026-03-11\
**Standards Compliance:** [OpenID4VP 1.0](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html) | [OpenID4VCI 1.0](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)

***

## What This Is

This solution provides **privacy-preserving age verification** for social media platforms using the **OpenID for Verifiable Presentations (OID4VP)** protocol. Instead of collecting sensitive identity documents (passport scans, ID photos), your platform requests a cryptographic proof that a user meets an age requirement — without ever seeing their actual date of birth, name, or ID number.

**Key value proposition:**

* Users prove "I am 18+" without revealing their exact age, name, or ID
* Zero personal data stored on your servers
* Compliant with OID4VP and OID4VCI open standards
* Works with government-issued digital identity credentials
* Single API integration — no credential handling on your side

***

## Why Social Media Platforms Need This

| Challenge                       | Traditional Approach                    | OID4VP Solution                                       |
| ------------------------------- | --------------------------------------- | ----------------------------------------------------- |
| Age gating for content/features | Ask for birthday (easily faked)         | Cryptographic proof from government-issued credential |
| Data liability                  | Store ID documents → GDPR/privacy risk  | Zero PII storage — only a boolean "verified" result   |
| User friction                   | Upload ID photo, wait for manual review | Scan QR code with wallet app, approve in seconds      |
| Regulatory compliance           | Varies by approach                      | Built on international open standards                 |
| Cross-platform trust            | Platform-specific solutions             | Interoperable across any OID4VP wallet                |

### Regulatory Context

Many jurisdictions now require or are moving toward mandatory age verification for social media:

* **EU Digital Services Act** — platforms must implement age-appropriate measures
* **UK Online Safety Act** — age verification for harmful content
* **US state laws** — growing number of states requiring age verification
* **Australia Online Safety Act** — age assurance requirements

OID4VP-based verification provides a standards-compliant, privacy-preserving solution that satisfies regulatory requirements while protecting user privacy.

***

## How It Works

### The User Journey (< 30 seconds)

<figure><img src="/files/jqrL8EO5TmDf9Cp226IL" alt=""><figcaption></figcaption></figure>

1. **User triggers verification** — taps a button, opens age-gated content, or creates an account
2. **Platform displays QR code** — generated from the OID4VP verification request
3. **User scans with digital wallet** — the wallet shows "Share proof you are 18+?"
4. **User approves** — wallet creates a zero-knowledge proof and submits it
5. **Platform receives callback** — `"verified": true` or `"verified": false`

### Technical Flow

***

<figure><img src="/files/JZKnH7GJCkb7TmCk8J6u" alt=""><figcaption></figcaption></figure>

## Architecture Overview

<figure><img src="/files/DYhiNlO0HQOkkQnGEaJ7" alt=""><figcaption></figcaption></figure>

### Components

| Component                 | Role                                                                | Your Responsibility |
| ------------------------- | ------------------------------------------------------------------- | ------------------- |
| **Social Media Platform** | Requests age verification, displays QR/link, handles callback       | **You build this**  |
| **OID4VP Verifier API**   | Orchestrates verification, validates proofs, sends callbacks        | **Hosted for you**  |
| **User's Wallet App**     | Stores digital credentials, creates proofs, gets user consent       | **User's device**   |
| **Credential Issuer**     | Issues digital identity credentials (government, trusted authority) | **Third party**     |

***

## Integration at a Glance

### What You Need to Build

1. **One API call** to create a verification request
2. **One QR code / deep link** displayed to the user
3. **One callback endpoint** to receive the verification result

### What You Don't Need to Build

* Credential storage or management
* Cryptographic proof verification
* Identity document processing
* User data storage for verification
* Wallet app integration

### Minimum Integration (3 Endpoints on Your Side)

{% stepper %}
{% step %}

### Trigger verification (your backend)

POST /v1/verification/request\
Returns: presentationId, deepLinkUrl
{% endstep %}

{% step %}

### Show QR code (your frontend)

Use deepLinkUrl or presentationId to display a QR code or deep link for the user to scan.
{% endstep %}

{% step %}

### Receive result (your callback endpoint)

POST to your callbackUrl\
Body: {verified: true/false, stateId, ...}
{% endstep %}
{% endstepper %}

***

## Standards Compliance

### OpenID for Verifiable Presentations (OID4VP)

This solution implements the [OID4VP specification](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html):

* **Response type:** `vp_token` — credential presentations instead of access tokens
* **Query language:** DCQL (Digital Credentials Query Language) for expressing requirements
* **Response mode:** `direct_post` — wallet submits VP directly to verifier endpoint
* **Nonce binding:** Cryptographic nonce prevents replay attacks
* **Format support:** Both JSON-LD (`ldp_vp`) and JWT (`jwt_vp`) verifiable presentations

### OpenID for Verifiable Credential Issuance (OID4VCI)

The credential ecosystem uses the [OID4VCI specification](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html):

* **Credential issuance:** Government or trusted authorities issue digital identity credentials to users' wallets
* **Selective disclosure:** SD-JWT VC and BBS+ signatures allow revealing only required claims
* **Key binding:** Credentials are cryptographically bound to the holder's wallet
* **Revocation support:** Issuers can revoke credentials when needed

### How the Standards Work Together

***

<figure><img src="/files/0RfsF3fda3uKBSbyYCov" alt=""><figcaption></figcaption></figure>

## Privacy by Design

### Zero-Knowledge Age Proofs

The system uses **BulletProof range proofs** — a zero-knowledge cryptographic technique:

| What the user proves     | What you learn    | What you DON'T learn     |
| ------------------------ | ----------------- | ------------------------ |
| "I am at least 18"       | `verified: true`  | Exact age, date of birth |
| "I am between 21 and 65" | `verified: true`  | Exact age                |
| "My age is under 13"     | `verified: false` | Nothing else             |

### Selective Disclosure with BBS+

When additional claims are needed (e.g., gender for content recommendations), **BBS+ signatures** allow the wallet to reveal only the requested fields:

* Full credential has: name, DOB, age, gender, ID number, address, photo
* You request: age ≥ 18, gender
* User shares: age proof (zero-knowledge) + gender value
* You never see: name, DOB, ID number, address, photo

### Data Flow Principles

1. **No PII transit** — zero-knowledge proofs contain no personal data
2. **No PII storage** — your platform stores only `verified: true/false`
3. **User consent** — the wallet explicitly asks the user before sharing anything
4. **Minimal disclosure** — only the exact claims you request are shared
5. **Cryptographic integrity** — all proofs are mathematically verifiable

***