verified-email

You can get a cryptographically verified email without OTPs by using Android Credential Manager to request an OpenID4VP SD-JWT credential. The device presents a built-in UI, extracts the vp_token for immediate client display, and sends the data to your server for validation.

Client-side parsing of SD-JWT claims only improves UX by displaying email and name immediately; it does not provide security. You must enforce mandatory server-side validation of the issuer, SD-JWT signature, key binding cnf, and original nonce to prevent replay and impersonation.

Android Credential Manager supports account creation, account recovery, and re-authentication flows using OpenID4VP DCQL requests. It retrieves a verified email credential from trusted providers, which can be optionally followed by passkey creation for secure access.

Your server must validate the issuer, SD-JWT signature, key binding cnf, and the original nonce for OpenID4VP SD-JWT credentials. This mandatory server-side cryptographic validation ensures the verified email attribute is authentic and prevents replay attacks before provisioning accounts.

Build a GetCredentialRequest containing a GetDigitalCredentialOption JSON to query a UserInfoCredential with email_verified using OpenID4VP DCQL. Android Credential Manager handles presenting the built-in UI and returning the vp_token and SD-JWT for your backend validation.