One paste.
One answer.
A widget whose source you can read today, a sandbox that is not open yet, and a public register wired so this page cannot oversell either. This is also the one page allowed to speak protocol names. Everywhere else they stay folded.
The whole integration.
PLANNEDAn age check is two lines in your page. This is not a teaser — it is the API.
<script src="https://orbis.id/v1/widget/orbis-verify.js" defer></script>
<orbis-verify ask="age_over_18" tenant="your-shop"></orbis-verify>The widget is written and its source is honest work you can audit: no shadow DOM, no external requests, every state narrated for screen readers, and a bundled mock verifier so the whole flow runs on your machine today. What is not live is the hosted script this snippet names, which is why the tag on this section says PLANNED, not almost.
What your page receives
document.addEventListener("orbis:verified", (e) => {
// e.detail = { session_id, claims_satisfied }
// That is the entire answer. No name, no birth date, no document.
fetch("/session/age-ok", { method: "POST",
body: JSON.stringify({ ref: e.detail.session_id }) });
});For anything that matters, trust the signed server callback: verify { session_id, claims_satisfied, timestamp, sig } against the platform's published keys; replays are refused by session_id. The browser event is UI convenience.
Honest states are part of the contract: a poll that has not returned renders as "waiting", four consecutive failures render as "lost contact". A non-answer is never rendered as an answer.
The ten-minute path.
PLANNEDNo sandbox is running today. Until it opens, this is a preview of the intended path, not instructions.
- Get a sandbox key. No sales call, no form longer than one field.
- Paste the widget, or curl the session endpoint directly.
- Approve the request on the hosted test phone in your browser.
- Verify the signed callback against our published keys. Done.
The register row (a hello-world you can run in ten minutes) is the source of truth for this section, and it says PLANNED.
A drawing of the intended path, marked as one. None of the hosts in the transcript answer today.
The protocols, named precisely.
LIVENo invented formats. The exact stack the EU's implementing acts cite.
| The job | The standard | Our implementation |
|---|---|---|
| The document format | SD-JWT VC — RFC 9901 | IN BUILD · P1 |
| Handing a document to a phone | OpenID4VCI (Final) | IN BUILD · P1 |
| Asking, and answering with only the fields chosen | OpenID4VP (Final) + DCQL | IN BUILD · P1 |
| Naming an issuer by its own domain | did:web | IN BUILD · P1 |
The LIVE tag covers one fact: that these are the formats EU implementing acts cite, a fact about law and specs, not about us. The build tags in the table are the claims about us, and none of them says LIVE: nothing issues yet. The register keeps the two apart.
Two API planes. One law.
PLANNEDThe side that checks never pays and never authenticates. The side that issues is keyed and versioned.
The verification plane (did.json, keys, status lists) is meant to be free, unauthenticated, unmetered, and standards-versioned, forever. Signed static files: verification keeps working with every origin of ours down.
The participation plane (issuing, depositing, managing) is keyed, rate-limited, and versioned under /v1 with a published deprecation window. New capabilities arrive as new versioned endpoints. Nothing is silently changed.
"Free forever" is an intention the owner has not signed. Its register row says exactly that.
If checking ever needs our permission, the design has failed.
Your integration never migrates.
PLANNEDThe old API's own tests are the acceptance suite for every new engine.
We call it the conformance oracle: a rebuilt engine ships only when the previous platform's contract tests pass against it on the wire. Your integration cuts over unchanged, or the engine does not ship. That is the gate, not a review step.
The same discipline runs outward: sixteen versioned test vectors (versioned, never mutated) and a CLI that checks any implementation against them. Vectors are the contract.
Design commitments, tagged PLANNED until the register can show the gate running.
Every way it can fail, catalogued.
PLANNEDRevoked, expired, bad nonce, wrong audience, clock skew, malformed disclosure — each with a runnable reproduction.
Failure documentation is where integrations go to die, and where this industry is weakest. The plan: every failure mode a verification can produce, documented with a curl line that reproduces it against the sandbox, so your 3am incident matches a page instead of a support queue.
Planned alongside the sandbox it needs. The tag will move when the catalogue exists, not when it is promised.
While the sandbox is closed.
-
Watch the ceremony you'd be integrating.
The home page runs the full consent ceremony as a labelled simulation.
Run it → -
Audit the claims.
Everything this page asserts resolves to the public capability register, including the tags we scored against ourselves.
Open the register → -
Be told when it opens.
The early list is the only notification rail, and its row is honest about not existing yet either.
Join the early list →