Sprime for developers

Add PROOFGATE to your site.

Get API keys, read the docs, and run the age and eligibility verifier in a sandbox before you go live. BADWALLET, our open-source test package, checks that a verifier turns bad credentials away.

Console and keys Create API keys and see how much traffic your integration is sending.
Credential API docs The /request, /verify, and /session endpoints under /v1/credentials.
Live sandbox Run the browser credential flow against the real verifier.
BADWALLET Valid and deliberately broken presentations for testing any verifier.

Looking for the product overview? It's on sprime.io.

No PII
Names, birth dates, and ID images are never stored
3 profiles
personhood, age_over_18, age_over_21
15 min
How long a session token lasts
2 formats
SD-JWT VC, plus mdoc where supported
The API

Two calls do the work.

Request a challenge, hand it to the customer's wallet, then send what the wallet returns to /verify.

Request Credential challenge 
GET /v1/credentials/request?profile=age_over_18

Returns:
- nonce
- requestId
- client_id for this host
- response_uri for this host
Verify Wallet presentation 
POST /v1/credentials/verify

Checks:
- nonce is single-use
- aud matches the stored origin
- trusted issuer is pinned
- only the requested predicate passes

A successful check returns pass or fail and an audit token that can't be traced back to the person. Nothing about their identity is stored.

Integration Path

Getting it running

01

Read the docs

Start with the credential API docs and the OpenAPI spec so you know the exact request and response shapes.

02

Run the sandbox

Issue a challenge from the sandbox and look at what the wallet sends back to the verifier.

03

Go live

Switch to production keys and keep an eye on your traffic in the dashboard.

BADWALLET

Break the verifier before a real wallet does.

BADWALLET emits a valid SD-JWT VC or mdoc presentation next to copies with one thing wrong: a stale nonce, a bad signature, a tampered disclosure, an untrusted issuer. A good verifier rejects each one for the right reason. We run it against PROOFGATE, and you can run it against yours.

Install MIT licensed, Node 20+ 
npm install --save-dev badwallet
npx badwallet list

13 fault families
SD-JWT VC and mdoc
Generate Fixtures bound to your request 
npx badwallet generate \
  --nonce req_7f92 \
  --audience https://verify.example \
  --origin https://checkout.example

How BADWALLET works · badwallet on npm

Resources

Docs, keys, and test tools

Credential API docs

Endpoint reference for challenges, verification, and session tokens.

Docs

Live sandbox

Run a credential check in your browser and see the verifier's response.

Sandbox

OpenAPI spec

Machine-readable schemas you can generate a client from.

Spec

Dashboard

Manage API keys and check usage.

Console

BADWALLET

Open-source fault catalog and fixture emitter for credential verifiers.

Package

Product overview

The non-technical explanation of PROOFGATE, for whoever is deciding whether to use it.

sprime.io
Pricing

Free to build, metered in production

You pay for completed verifications. The sandbox is free, and production starts at $250 a month with 5,000 checks included.

Sandbox
$0
no card required
  • Credential request challenge
  • Sandbox verifier walkthrough
  • OpenAPI reference
  • Developer examples
  • No personal data stored
  • No production SLA
Open sandbox
Production
$250
per month, includes 5,000 checks
  • Production API keys
  • 5,000 verifications included
  • $0.05 per additional check
  • Issuer allowlist controls
  • Audit log with no personal data
  • Integration support
Start production
Volume
Custom
for high volume
  • Higher-throughput verification
  • Customer audit exports
  • Issuer allowlist planning
  • Operational review
  • Contracted support
  • Launch coordination
Contact sales
FAQ

Common questions

What does the host receive?

Your site gets the verification result, the claim profile it asked for, and an audit token that can't be traced back to the person. Raw identity fields are never stored.

Which profiles are supported?

The current profiles are personhood, age_over_18, and age_over_21. Unknown explicit profiles return 400 instead of falling through to another gate.

How is the verifier origin bound?

The request endpoint stores the serving origin with the nonce. The verify endpoint rebuilds the expected audience from that stored origin before accepting a presentation.

Can I test without a compatible wallet?

Partly. The sandbox still shows you the real challenge payload, but it won't fake a successful wallet response.

What's the difference between sprime.us and sprime.io?

sprime.io explains PROOFGATE to businesses. sprime.us is where developers get keys, read the docs, use the sandbox, and find BADWALLET.

Does BADWALLET cost anything or need PROOFGATE?

No to both. It's a free MIT-licensed npm package. The fixtures work against any verifier. The adapter that submits them and compares the response ships for PROOFGATE first.

Building a PROOFGATE integration?

Start with the credential docs, then run a check in the sandbox.

Open credential docs →