Developer Guide: Build a Verifier

This guide is for technical teams who need to integrate the EU Age Verification solution into their online service. It outlines the key steps, relevant documentation and open-source resources, and provides guidance on implementation and testing.

0. Quick Start: Try It Without Any Setup

Before building anything, we recommend trying the full verification flow using the ready-made demo components. A hosted verifier and wallet apps are available to get you started without any local setup.

Use these to understand the user experience and the protocol before starting implementation.

Try the app

1. Understand Your Policy and Requirements

Before starting implementation, define how age verification should function in your service together with your compliance team.

Key decisions include:

Age thresholds and regional differences Define which age limits apply (e.g. 13+, 16+, 18+) to your services and content.
When to trigger age verification
On entry to the service
Only when accessing restricted content
Only for specific actions (e.g. purchases)
Frequency of checks
Every session
Once per device
Periodically (e.g. after X days)

These rules should be defined jointly with compliance and aligned with the European Commission's guidelines for protecting minors online.

You should also follow core design principles such as: - Data minimisation - Unlinkability - Limited data retention

2. Presentation Flow and Integration Requirements

When a user needs to verify their age, they present a cryptographic proof from their app to your verifier. No personal data is shared, only confirmation that the age requirement is met.

Age verification relies on two presentationmechanism and two proof types. Your verifier must support all combinations and select the best available option at runtime.

DC API (Digital Credentials API) is a browser-integrated API that enables direct communication between your web service and the user's wallet with the same device or across devices. It provides the best user experience and is the primary integration method.

OID4VP (OpenID for Verifiable Presentations) is an OpenID-based protocol used as a fallback when the user's browser does not support DC API.

ZKP (Zero-Knowledge Proof) is an enhanced proof format that provides the same yes/no confirmation with stronger privacy guarantees. No linkable identifier is disclosed, making it impossible to track users across services.

Standard mdoc attestation is a signed proof confirming the user meets the age threshold. To prevent linkability, the proofs are one time usable and issued in batches.

For a detailed walkthrough of the presentation flow, see Presenting a proof of age attestation.

Full support across browsers and wallet apps is still evolving. To work for all users today, your verifier must support all combinations and select the best available option at runtime:

DC API + ZKP: preferred
DC API + standard mdoc: if wallet has no ZKP support
OID4VP + standard mdoc: if browser has no DC API support

The diagram below illustrates both what your verifier must implement and the decision logic for selecting the right mechanism at runtime.

flowchart TD
    A([User is asked to verify age]) --> B{DC API available?}
    B -->|Yes| C{ZKP available?}
    B -->|No| F[OID4VP]
    C -->|Yes| D[DC API + ZKP]
    C -->|No| E[DC API + standard mdoc]
    D --> G([Validate proof])
    E --> G
    F --> G

    style D fill:#E1F5EE,stroke:#1D9E75,color:#085041
    style E fill:#EEEDFE,stroke:#534AB7,color:#26215C
    style F fill:#FAECE7,stroke:#D85A30,color:#4A1B0C

3. Build Your Verifier

Two reference implementations are available as starting points:

Basic Verifier UI (React / TypeScript): a minimal reference implementation showing the core flow: - https://github.com/eu-digital-identity-wallet/av-web-verifier-ui

Cinema Verifier Showcase: a domain-specific example showing what a real-world integration could look like: - https://ageverification.dev/av-verifier-frontend-starfilm/

Neither is production-ready as-is, but both are useful references for understanding how the verifier handles the different protocol and proof format combinations.

Important: A hosted instance of the reference verifier is available for development and testing support. This is not a production service. You must build and host your own verifier, including the verifier backend. Do not build your production verifier against the hosted instance.

Trusted List

Your verifier must validate all attestations against the Age Verification Trusted List before granting access.

For development and testing, the European Commission provides a hosted test trusted list.

4. Testing

To test your implementation, use the ready-made wallet apps alongside your verifier. Install either the Android or iOS AV Wallet on your mobile device.

Install the application)

These allow you to enrol a Proof of Age attestation and test the full end-to-end flow against your verifier, including DC API and OID4VP fallback, and ZKP vs standard attestation presentations. Use the EU-hosted test Trusted List at acceptance.eidas.ec.europa.eu during development.

End-to-End Testing with Ecosystem Partners

For more advanced testing, it is strongly recommended to perform end-to-end tests with Member States and other Age Verification Solution providers implementing age verification solutions, to validate interoperability across different implementations.

Contact the project team via https://ageverification.dev/Support/ to coordinate testing with other ecosystem participants.

5. Further Resources

Architecture and technical specifications https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/
Zero-Knowledge Proofs (Annex B) https://ageverification.dev/av-doc-technical-specification/docs/annexes/annex-B/annex-B-zkp/
AV Profile (attestation formats and protocols) https://ageverification.dev/av-doc-technical-specification/docs/annexes/annex-A/annex-A-av-profile/
Support and contact https://ageverification.dev/Support/