Documentation

Overview

NMKR Identity helps Cardano NFT projects and real-world asset (RWA) issuers establish cryptographically verifiable identity. Projects prove who they are using Atala PRISM DIDs and W3C Verifiable Credentials instead of screenshots or social media posts.

The platform produces signed CIP-725 metadata for on-chain submission, linking your token policy to a verified identity. Any third party can independently verify the entire chain of trust without contacting us.

Problems Solved

• Project impersonation — DIDs provide cryptographic proof of identity tied to a keypair you control.
• Unverifiable claims — Verifiable Credentials are signed and tamper-evident.
• No on-chain identity link — 725 metadata embeds your DID and credential URLs directly in token metadata.
• RWA compliance — Attach jurisdiction, registration numbers, and asset types to credentials.

Core Concepts

Four building blocks make up the identity and verification system.

How It Works

From registration to on-chain metadata in six steps.

Verification Chain

Anyone can verify a project's identity by checking independent signatures. No account or API key needed.

Step-by-Step

1. Fetch the VC — Call the credential's public URL. Read issuer to get the DID.
2. Fetch the DID Document — Call the public DID endpoint. Extract the public key from verificationMethod[0].publicKeyJwk.
3. Verify the DID Document — The proof.signatureValue is a secp256k1 signature over the canonicalized payload.
4. Verify the VC — Remove proof, canonicalize, verify proof.jws against the DID's public key.
5. Verify the Attestation — Contains the platform's public key (verifierJwk). Verify its signature.
6. Check Status — Call credentialStatus.id to confirm active (not revoked).

Signature Details

Public API

All public endpoints require no authentication. Responses are JSON.

{
  "@context": ["https://www.w3.org/2018/credentials/v1"],
  "type": ["VerifiableCredential", "TokenProjectVerification"],
  "issuer": { "id": "did:prism:abc123..." },
  "credentialSubject": { "policyID": "a1b2c3...", "label": "Main Collection" },
  "proof": { "type": "EcdsaSecp256k1Signature2019", "jws": "..." }
}

{ "status": "active" }

{
  "did": "did:prism:abc123...",
  "didDocument": { ... },
  "attestations": [ ... ],
  "kycStatus": "approved"
}

{ "status": "ok" }

Authenticated API

Requires a Bearer token (generated in Settings) or an active session.

Authorization: Bearer your_api_token_here

Integration Guide

For Token Projects

1. Register and create a DID for your company/project.
2. Complete KYC and wait for admin approval.
3. Create a credential for each Cardano policy.
4. Generate 725 metadata for the credential.
5. Submit metadata on-chain as part of your minting transaction.
6. Share your credential URL with marketplaces and community.

For Wallets & Marketplaces

1. Read 725 metadata from on-chain transactions (key: 725).
2. Extract the DID and credential URL from the files array.
3. Fetch and verify using the public API endpoints.
4. Display verification status in your UI.

725 Metadata Structure

{
  "725": {
    "1.0": {
      "{policy_id}": {
        "{collection}": {
          "type": "JsonWebKey2020",
          "files": [
            { "src": "did:prism:abc...", "name": "Token-Identity" },
            { "src": "https://identity.nmkr.io/api/credentials/1", "name": "Verification-Credential" }
          ],
          "proof": { "type": "EcdsaSecp256k1Signature2019", "signatureValue": "..." }
        }
      }
    }
  }
}

Verification in Code

# 1. Fetch the credential
vc = GET /api/credentials/{id}

# 2. Fetch the DID
did_info = GET /api/dids/{did_id}/public
pubkey = did_info.didDocument.verificationMethod[0].publicKeyJwk

# 3. Verify DID Document signature
verify_secp256k1(pubkey, canonicalize(payload), proof.signatureValue)

# 4. Verify VC signature
verify_secp256k1(pubkey, canonicalize(vc_without_proof), proof.jws)

# 5. Check status
status = GET /api/credentials/{id}/status
assert status.status == "active"

Standards & Cryptography

Design Decisions

• Self-signed DIDs — No external authority needed to create or validate.
• Issuer is a DID — Credential issuers are identified by DID, not a centralized account.
• Attestation as VC — The platform's endorsement is a standard W3C VC.
• Canonical JSON — Signatures computed over sorted-key JSON for stability.
• No blockchain writes — The platform generates metadata; you publish on-chain.
• Key never stored in plaintext — Encrypted immediately; passphrase shown once.

FAQ