https://developer.android.com/agents/skills/identity/verified-email/skill

You can verify users' email by using Android Credential Manager with an OpenID4VP request for the UserInfoCredential, parsing the returned vp_token for UI updates, and forwarding the response to your backend for server-side nonce and signature validation.

The best way to retrieve a verified email is to construct a GetCredentialRequest with GetDigitalCredentialOption, present the system UI for the OpenID4VP request, and perform full server-side validation of the SD-JWT before creating the user account.

Yes, you can use OpenID4VP with Credential Manager for high-risk reauthentication by requesting the UserInfoCredential, applying the same client-side retrieval and server-side nonce validation process used for account recovery.

Yes, server-side validation requires the original nonce. You must forward the full credential response JSON along with the nonce to your backend to cryptographically validate the SD-JWT signature before logging in the user.

When parsing the vp_token for verified email retrieval, you must handle the SD-JWT structure carefully on the client side for safe UI updates, while recognizing that true security depends entirely on subsequent server-side nonce and signature validation.

Yes, a backend server is required to perform full cryptographic server-side validation of the nonce and signature, ensuring the verified email retrieved via Credential Manager is authentic before completing the account recovery flow.