Reveal only the attributes you pick. Hidden fields stay hashed under a salted Merkle root signed by the issuer.

Prove "age ≥ 18", "nationality ∈ EU set", or "KYC tier ≥ 2" without revealing the underlying value. Groth16 over BLS12-381.

ECDSA P-256 signing inside the secure enclave. Private keys never touch JavaScript or your servers.

Revoke, suspend, reactivate. Verifiers receive push events over WebSocket — invalidate cached results instantly.

DigiD, BankID, OIDC, SAML, and Didit KYC out of the box. Bring your own provider via the form, OIDC, or webhook flows.

Issuer keys, revocations, and identity commitments published on Midnight. No central directory, no key escrow.