Identity overview

Issuing and verifying Verifiable Credentials for Sybil resistance and agent attestation.

This section is a placeholder pending finalization of the identity endpoints. Shapes below are illustrative of the intended POST /v1/credentials and GET /v1/credentials/{id}/verify surface.

OpenFi credentials are W3C Verifiable Credentials in VC-JWT format, issued from did:web:openfi.co, with wallet-based subjects addressed via did:pkh.

Issue a credential

curl https://api.openfi.co/v1/credentials \
  -H "Authorization: Bearer $OPENFI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subject_did": "did:pkh:eip155:1:0xabc123...",
    "credential_type": "verified_bank_account"
  }'

200

{
  "id": "vc_01HA1...",
  "jwt": "eyJhbGciOi...",
  "issuer": "did:web:openfi.co",
  "subject_did": "did:pkh:eip155:1:0xabc123...",
  "credential_type": "verified_bank_account",
  "issued_at": "2026-08-27T14:10:00Z"
}

Verify a credential

curl https://api.openfi.co/v1/credentials/vc_01HA1.../verify \
  -H "Authorization: Bearer $OPENFI_API_KEY"

200

{
  "valid": true,
  "revoked": false,
  "credential_type": "verified_bank_account"
}

Scope notes

• Identity/Sybil-resistance enforcement is folded into the Aptos allowance-state-machine module, not a standalone on-chain module.
• Stellar-side settlements currently have no identity gate. This is a tracked gap, not a design assumption of parity with Aptos.
• Credential schemas are candidates for open-sourcing (Apache 2.0 / CC0); the issuance decision logic itself stays closed.