Getting started with the Verifier SDKs

Make a request of the following structure to create an iOS Verifier Application configuration on your MATTR VII tenant:

POST /v2/presentations/applications

{
    "name": "My iOS Verifier Application",
    "type": "ios",
    "bundleId": "com.yourcompany.verifierapp",
    "teamId": "YOUR_APPLE_TEAM_ID",
    "maxTimeOfflineInSecs": 864000,
    "appAttest": {
        "required": true,
        "environment": "production"
    }
}

• name: A unique name to identify this Verifier Application.
• type: Must be ios.
• bundleId: The Bundle ID of your iOS app (must match your Xcode project configuration).
• teamId: Your Apple Developer Team ID.
• maxTimeOfflineInSecs: Maximum number of seconds the SDK can operate offline before requiring a new license token. Must be between 1 day (86400) and 30 days (2592000). Defaults to 7 days (604800).
• appAttest: App Attest configuration for the iOS verifier application:
  • required: When true, the app instance must provide a valid App Attest attestation during registration and token renewal. When false, the app can fall back to assertion-only authentication. See Attestation vs Assertion for more details.
  • environment: The App Attest environment (development or production). Apple recommends using development for testing and production for distribution builds.

A successful response returns a 201 status code with the created Verifier Application:

{
    "id": "1ef1f867-20b4-48ea-aec1-bea7aff4964c", 
    "name": "My iOS Verifier Application",
    "type": "ios",
    "bundleId": "com.yourcompany.verifierapp",
    "teamId": "YOUR_APPLE_TEAM_ID",
    "maxTimeOfflineInSecs": 864000,
    "appAttest": {
        "required": true,
        "environment": "production"
    }
}

• id: A unique identifier for the Verifier Application (generated by the tenant). You must use this value when initializing the SDK so that it can correctly identify and authenticate your application.

Make a request of the following structure to create an Android Verifier Application configuration on your MATTR VII tenant:

POST /v2/presentations/applications

{
    "name": "My Android Verifier Application",
    "type": "android",
    "packageName": "com.yourcompany.verifierapp",
    "packageSigningCertificateThumbprints": [
        "1232584B6F6A892D356899FB9576C5F226A179E6199F2B7A1D837B5C234C5A8E"
    ],
    "maxTimeOfflineInSecs": 864000,
    "keyAttestation": {
        "required": true
    }
}

• name: A unique name to identify this Verifier Application.
• type: Must be android.
• packageName: The package name of your Android application.
• packageSigningCertificateThumbprints: SHA-256 hex-encoded fingerprints of the signing key certificates used to sign your APK or app bundle. This ensures the tenant only accepts requests from known and trusted applications. Refer to Android app signing for more information.
• maxTimeOfflineInSecs: Maximum number of seconds the SDK can operate offline before requiring a new license token. Must be between 1 day (86400) and 30 days (2592000). Defaults to 7 days (604800).
• keyAttestation: Key Attestation configuration for the Android verifier application:
  • required: When true, the app instance must provide a valid Key Attestation during registration and token renewal. When false, the app can register and renew tokens using just an authentication assertion. See Attestation vs Assertion for more details.

A successful response returns a 201 status code with the created Verifier Application:

{
    "id": "a82bfa46-72a0-4cde-b6cb-2a0de7e2f3c4", 
    "name": "My Android Verifier Application",
    "type": "android",
    "packageName": "com.yourcompany.verifierapp",
    "packageSigningCertificateThumbprints": [
        "1232584B6F6A892D356899FB9576C5F226A179E6199F2B7A1D837B5C234C5A8E"
    ],
    "maxTimeOfflineInSecs": 864000,
    "keyAttestation": {
        "required": true
    }
}

• id: A unique identifier for the Verifier Application (generated by the tenant). You must use this value when initializing the SDK so that it can correctly identify and authenticate your application.

If you use remote mobile (app-to-app) verification, create a Verifier Application for each platform you target by following the iOS and Android tabs above. You then pass the matching application id to requestMobileCredentials at runtime, selecting it based on Platform.OS:

import { Platform } from "react-native";

const verifierApplicationId =
  Platform.OS === "ios"
    ? "YOUR_IOS_VERIFIER_APPLICATION_ID"
    : "YOUR_ANDROID_VERIFIER_APPLICATION_ID";

• YOUR_IOS_VERIFIER_APPLICATION_ID : The id returned when you created the iOS Verifier Application.
• YOUR_ANDROID_VERIFIER_APPLICATION_ID : The id returned when you created the Android Verifier Application.

Initialize the SDK with your platform configuration. The initialize method is asynchronous, so call it from an asynchronous context:

let platformConfig = PlatformConfiguration(
    tenantHost: URL(string: "https://your-tenant.vii.mattr.global")!,
    applicationId: "1ef1f867-20b4-48ea-aec1-bea7aff4964c"
)
try await MobileCredentialVerifier.shared.initialize(
    platformConfiguration: platformConfig
)

• tenantHost: The URL of your MATTR VII tenant. This must be the tenant where your iOS Verifier Application is configured.
• applicationId: The id of your configured iOS Verifier Application.

Initialize the SDK with your platform configuration:

val platformConfig = PlatformConfiguration(
    tenantHost = URL("https://your-tenant.vii.mattr.global"),
    applicationId = "1ef1f867-20b4-48ea-aec1-bea7aff4964c"
)
MobileCredentialVerifier.initialize(context, platformConfig)

• tenantHost: The URL of your MATTR VII tenant where your Android Verifier Application is configured.
• applicationId: The id of your configured Android Verifier Application.

The React Native Verifier SDK is not tethered, so initialization does not register an app instance or require an applicationId. You can initialize without any options for in-person (proximity) verification:

import { initialize } from "@mattrglobal/mobile-credential-verifier-react-native";

const result = await initialize();

if (result.isErr()) {
    console.error("Failed to initialize SDK:", result.error);
}

If you use remote mobile (app-to-app) verification, pass a platformConfiguration with your tenant host. The tenantHost is the only field, and it is required for requestMobileCredentials:

const result = await initialize({
    platformConfiguration: {
        tenantHost: "https://your-tenant.vii.mattr.global",
    },
});

if (result.isErr()) {
    console.error("Failed to initialize SDK:", result.error);
}

The verifier application id is passed per request to requestMobileCredentials, not at initialization. See the remote mobile verification tutorial for details.