Public Verification

Verify AssureLocker credentials without trusting AssureLocker.

Credentials, receipts and registry anchors are designed to be checked from public issuer keys, public status endpoints and the signed artefact itself. This page keeps the identifiers in one place.

Issuer DID

did:web:id.assurelocker.com

DID document

id.assurelocker.com/.well-known/did.json

Issuer JWKS

id.assurelocker.com/.well-known/jwks.json

API key mirror

api.assurelocker.com/v1/keys/issuer-public-key

What to Check

The credential signature resolves to an AssureLocker issuer key.

The issuer DID and key identifier match the public DID document or JWKS.

The credential status endpoint does not show revoked or suspended.

Any registry anchor hash matches the credential or receipt payload you were given.

Verifier Sketch

1. Decode the credential or receipt.
2. Read iss, kid, alg and status fields.
3. Resolve iss to the DID document or JWKS.
4. Select the public key by kid.
5. Verify the signature over the original bytes.
6. Fetch credential status, if present.
7. Recompute any payload hash.
8. Compare the recomputed hash with the registry anchor.
9. Check expiry, issuer and intended audience.
10. Accept only if every check succeeds.

Primary issuer posture

New AssureLocker-issued credentials use asymmetric issuer keys. ML-DSA-65 is the primary long-lived signature posture; ES256 or RS256 may appear where a relying party needs classical JOSE compatibility. The authoritative key set is the public DID document and JWKS, not a private email or screenshot.

Need the broader controls context? Read Trust & Security.