skills.rest
android
androidOFFICIAL
Explore all skills by this author →
Website𝕏@AndroidDevGitHub

verified-email

Retrieve cryptographically verified emails via Android Credential Manager with OpenID4VP.

6.6k|388|Updated Mar 16, 2026
Search Tags:#server-side validation#sd-jwt#openid4vp#digital credentials#verified email#credential manager#otp-less auth
One-click install
npx skills add https://github.com/android/skills --skill verified-email-android
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: verified-email
Source: https://github.com/android/skills/tree/main/identity/verified-email
Command: npx skills add https://github.com/android/skills --skill verified-email-android

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It removes the friction of high-friction sign-up and recovery flows by retrieving a cryptographically verified email from Android Credential Manager instead of relying on OTPs or magic links.

Core Features & Use Cases

  • Verified email retrieval via Credential Manager: Uses a Digital Credential (OpenID4VP) request to obtain an issuer-verified email_verified claim from trusted providers (e.g., Google consumer accounts).
  • Client-side parsing with server-side trust: Supports quick client parsing for UI updates while requiring full cryptographic validation and nonce checking on your server before account creation or login.
  • Production security guardrails: Enforces critical requirements like unique nonce generation, server-side issuer/signature verification, and presenter identity validation via cnf.
  • Common use cases: Sign-up/account creation (reduce conversion drop-off), account recovery (securely verify ownership), and re-authentication for sensitive actions.

Quick Start

Use the verified-email skill to construct an OpenID4VP GetDigitalCredential request, call Credential Manager getCredential(), and send the returned responseJsonString plus the original nonce to your server for cryptographic validation before creating or logging in the user.

Frequently Asked Questions about verified-email

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify user email on Android without OTP?▼

You can verify user email without OTP by using Android Credential Manager’s Digital Credentials with an OpenID4VP request flow to retrieve a cryptographically verified email. This method requires server-side validation of the returned credentialJson and nonce.

What are the requirements for using Digital Credentials to retrieve a verified email?▼

Using Digital Credentials for verified email retrieval requires Android API level 28+ and Google Play services 25.49.x+. Your server must also perform cryptographic validation of the issuer, SD-JWT signature, and presenter identity via the cnf claim.

How does server-side validation work for OpenID4VP Digital Credentials?▼

Server-side validation for OpenID4VP Digital Credentials involves cryptographically verifying the issuer, checking the SD-JWT signature, validating presenter identity from the cnf claim, and confirming nonce-based replay protection using the returned credentialJson.

Can I use Credential Manager for account recovery and re-authentication?▼

Yes, you can use Credential Manager with Digital Credentials for account recovery and re-authentication. It securely verifies email ownership by retrieving an issuer-verified email_verified claim without relying on magic links or OTPs.

Why do I need nonce-based replay protection for digital credential authentication?▼

Nonce-based replay protection is required for digital credential authentication to prevent intercepted responses from being reused. Your server must check the original nonce sent in the OpenID4VP request against the returned credentialJson.

What is the difference between OTPless authentication and OpenID4VP?▼

OpenID4VP is a protocol that enables OTPless authentication by requesting digital credentials from providers like Google, returning a cryptographically signed SD-JWT. Unlike OTPs, it requires server-side validation of the issuer and presenter identity.

Related Skills

Explore More Software Engineering Skills→
Kaito-DogiKaito-Dogi

verified-email

Verify email addresses on Android using the Credential Manager API.

Community
Advanced
klxiaoniuklxiaoniu
174

verified-email

Retrieve cryptographically verified email via Android Credential Manager with OpenID4VP.

Community
Advanced
uyelikaniluyelikanil

verified-email

Retrieve cryptographically verified emails via Android Credential Manager and OpenID4VP.

Community
Advanced
premex-abpremex-ab
1

verified-email

Retrieve cryptographically verified user email via Android Credential Manager with OpenID4VP.

Official
Advanced