Verify a credential with nobody on the line
ATX is the credential face: AIP proves the key, ATP logs the trust, and ATX packs all of it into one signed, self-contained credential the agent carries and any verifier checks locally.
Before the spec: the usual way
The usual way: on every call, ask a central authority 'is this agent still trusted?'. The request blocks on the network, latency climbs, and if the authority is down, trust breaks.
nothing yet
The Ed25519 signature here is verified for real in your browser, so tampering any signed field fails. An ML-DSA-65 post-quantum signature is verified when a credential carries one; this fixture shows a placeholder for it, and the lab labels it rather than re-running a heavy PQ check on a phone. Revocation is a locally cached list plus a short credential lifetime, not a live lookup. A declared purpose (declaredPurpose) is an optional ATX 1.1 field; a 1.0 verifier ignores it.
import { LocalAtxVerifier } from "@opena2a/atx-verify";
// No callback: version, expiry, revocation, issuer trust, and the Ed25519
// signature are all checked locally. Anchors are injected; the library does no I/O.
const verifier = new LocalAtxVerifier({
trustedIssuers: ["did:opena2a:authority:opena2a.org"],
publicKeys: cachedIssuerKeys, // e.g. from the issuer's DID Document, 1-hour TTL
crl: localRevocationCache, // 5-minute TTL
});
const result = verifier.verify(credential);
if (result.valid) proceed(); // local check, safe even if the authority is offline