← Back to Documentation

Delegated Verification Guide

Issue Cardless ID credentials to your verified users via trusted issuer API

Overview

Delegated verification allows trusted issuers (banks, government agencies, employers, universities, etc.) to issue Cardless ID credentials to their users without requiring them to go through a full identity verification flow.

This is ideal for organizations that have already verified their users' identities and want to provide them with portable, privacy-preserving digital credentials.

Issuer Registry & Security Audit Required

Cardless ID maintains an Algorand smart contract that serves as a registry of trusted issuers. Only credentials issued by addresses in this on-chain registry will be recognized as valid by verifiers in the Cardless ID ecosystem.

Before production deployment: Your organization must complete a security audit and approval process. We review your verification procedures, security practices, and compliance measures before adding your issuer address to the registry.

Contact Us

How It Works

┌─────────────┐                           ┌──────────────┐
│   Bank/DMV  │                           │  Cardless ID │
│   (Issuer)  │                           │   Platform   │
└─────────────┘                           └──────────────┘
       │                                          │
       │                                          │
       │  1. POST /api/delegated-verification/issue
       │     - API Key                            │
       │     - User's wallet address              │
       │     - Identity data                      │
       │─────────────────────────────────────────>│
       │                                          │
       │                2. Verify API key         │
       │                3. Generate credential    │
       │                4. Store on Algorand      │
       │                                          │
       │  5. Return credential ID                 │
       │<─────────────────────────────────────────│
       │                                          │
       │  6. Notify user                          │
       │     "Your Cardless ID is ready!"         │

Use Cases

1. Banks (KYC Completed)

Banks that have completed Know Your Customer (KYC) verification can issue Cardless ID credentials to their account holders.

Example: Chase Bank issues Cardless ID to verified customers, allowing them to prove age without sharing banking information.

2. Government Agencies (DMV, Social Security)

Government agencies that issue identity documents can directly issue digital credentials.

Example: California DMV issues Cardless ID when renewing driver's license.

3. Universities (Student Credentials)

Universities can issue credentials to enrolled students for age verification and student discounts.

Example: Stanford issues Cardless ID to all students for campus events and online student discounts.

4. Employers (Employee Verification)

Employers can issue credentials to employees for workplace access and benefits.

Example: Google issues Cardless ID to employees for building access and corporate discounts.

5. Healthcare Providers

Healthcare organizations can issue credentials to patients for age-gated services.

Example: Kaiser Permanente issues Cardless ID to patients for prescription refills requiring age verification.

Getting Started

Step 1: Request API Key

Contact Cardless ID to request an API key for your organization:

Include: Organization name, type, contact email, website, use case, expected volume

Step 2: Receive Credentials

You'll receive:

  • API Key: api_key_example_not_real_xxxxxxxxxxxxxxxx
  • Documentation: This guide
  • Sandbox API Key: For testing

Step 3: Integrate API

Use the API endpoint to issue credentials to your users.

API Reference

Endpoint

POST https://cardlessid.com/api/delegated-verification/issue

Request Body

{
  "apiKey": "your_api_key_here_not_a_real_key_example",
  "walletAddress": "MWCAXBUMUK3I2NTVEHDA6JVQ2W7IMKJUJSGEKQTRMFYYE3W6GJUSHUAGJM",
  "identity": {
    "firstName": "Jane",
    "lastName": "Doe",
    "dateOfBirth": "1990-01-15",
    "documentNumber": "D1234567",
    "documentType": "government_id",
    "issuingCountry": "US",
    "issuingState": "CA"
  }
}

Request Fields

FieldTypeRequiredDescription
apiKeystringYesYour API key from Cardless ID
walletAddressstringYesUser's Algorand wallet address (58 characters)
identity.firstNamestringYesUser's middle name
identity.middleNamestringYesUser's middle name
identity.lastNamestringYesUser's last name
identity.dateOfBirthstringYesDate of birth (YYYY-MM-DD format)
identity.documentNumberstringNoID document number
identity.documentTypestringNodrivers_license, passport, or government_id

Response (Success)

{
  "success": true,
  "credentialId": "cred_1234567890_abc123",
  "walletAddress": "MWCAXBUMUK3I2NTVEHDA6JVQ2W7IMKJUJSGEKQTRMFYYE3W6GJUSHUAGJM",
  "compositeHash": "a1b2c3d4e5f6...",
  "sessionId": "session_1234567890",
  "issuer": {
    "name": "Example Bank",
    "type": "bank"
  }
}

Error Responses

401 Unauthorized

{
  "error": "Invalid API key"
}

400 Bad Request

{
  "error": "Invalid Algorand wallet address. Must be 58 characters."
}

Implementation Examples

Node.js / TypeScript

import fetch from 'node-fetch';

async function issueCardlessId(
  walletAddress: string,
  userData: {
    firstName: string;
    lastName: string;
    dateOfBirth: string;
  }
) {
  const response = await fetch('https://cardlessid.com/api/delegated-verification/issue', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      apiKey: process.env.CARDLESSID_API_KEY,
      walletAddress,
      identity: userData
    })
  });

  if (!response.ok) {
    const error = await response.json();
    throw new Error(`Failed to issue credential: ${error.error}`);
  }

  const result = await response.json();
  console.log('Credential issued:', result.credentialId);

  return result;
}

// Usage
await issueCardlessId(
  'MWCAXBUMUK3I2NTVEHDA6JVQ2W7IMKJUJSGEKQTRMFYYE3W6GJUSHUAGJM',
  {
    firstName: 'Jane',
    lastName: 'Doe',
    dateOfBirth: '1990-01-15'
  }
);

Python

import requests
import os

def issue_cardless_id(wallet_address, user_data):
    response = requests.post(
        'https://cardlessid.com/api/delegated-verification/issue',
        json={
            'apiKey': os.environ['CARDLESSID_API_KEY'],
            'walletAddress': wallet_address,
            'identity': user_data
        }
    )

    response.raise_for_status()
    result = response.json()

    print(f"Credential issued: {result['credentialId']}")
    return result

# Usage
issue_cardless_id(
    'MWCAXBUMUK3I2NTVEHDA6JVQ2W7IMKJUJSGEKQTRMFYYE3W6GJUSHUAGJM',
    {
        'firstName': 'Jane',
        'lastName': 'Doe',
        'dateOfBirth': '1990-01-15'
    }
)

cURL

curl -X POST https://cardlessid.com/api/delegated-verification/issue \
  -H "Content-Type: application/json" \
  -d '{
    "apiKey": "your_api_key_here_not_a_real_key_example",
    "walletAddress": "MWCAXBUMUK3I2NTVEHDA6JVQ2W7IMKJUJSGEKQTRMFYYE3W6GJUSHUAGJM",
    "identity": {
      "firstName": "Jane",
      "lastName": "Doe",
      "dateOfBirth": "1990-01-15",
      "documentNumber": "D1234567",
      "documentType": "government_id",
      "issuingCountry": "US",
      "issuingState": "CA"
    }
  }'

Best Practices

Security

  • • Store API keys in environment variables
  • • Never commit API keys to version control
  • • Rotate regularly (every 90 days)
  • • Use separate keys for dev/staging/production

Error Handling

  • • Retry failed requests with exponential backoff
  • • Log all errors for debugging
  • • Provide clear error messages to users
  • • Monitor API usage and errors

User Experience

  • • Explain what Cardless ID is
  • • Show benefits to users
  • • Help users download wallet app
  • • Confirm successful issuance

Compliance

GDPR (European Union)

  • Right to access: Users can request credential data
  • Right to erasure: Users can request credential revocation
  • Data minimization: Only required fields are transmitted
  • Lawful basis: Legitimate interest or consent

CCPA (California)

  • Data disclosure: Users can request information about data collection
  • Right to delete: Users can request credential deletion
  • No sale of data: Credentials are not sold to third parties

HIPAA (Healthcare)

  • Protected Health Information (PHI) is not stored in credentials
  • Only age/identity information is included
  • Credentials are encrypted on blockchain
  • Audit logs track all issuance

Related Documentation

Ready to Get Started?

Request API Key

Support

  • 📧 Email: me@djscruggs.com
  • 🐛 Issues: GitHub Issues
  • 💬 Community: Discord (coming soon)