Sign in with Prson

<prson-signin-button id="signin" variant="amber" size="lg"></prson-signin-button>
<script type="module">
  import "@prson/login-sdk-ui";
  import { PrsonLogin } from "@prson/login-sdk";

  document.querySelector("#signin").addEventListener("click", async () => {
    const result = await PrsonLogin.signIn({
      // A one-time nonce from YOUR server, fresh for each code shown.
      nonce: async () => (await fetch("/auth/prson/nonce", { method: "POST" }).then((r) => r.json())).nonce,
      required: {
        minVerificationLevel: 5,          // a passport or ID card chip checked by Prson
        predicates: ["age_gte_18"],       // facts: yes or no only
        requiredClaims: ["given_name"],   // claims: the value
      },
    });
    // Check it on your server; result.claims here is only a copy for the page.
    await fetch("/auth/prson", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ presentation: result.sdJwtVc, nonce: result.nonce }),
    });
  });
</script>

import { randomBytes } from "node:crypto";
import { verifyPresentation } from "@prson/login-verifier";

// 1. A nonce per code: keep it server side, use it once.
app.post("/auth/prson/nonce", (req, res) => {
  const nonce = randomBytes(16).toString("base64url");
  req.session.prsonNonce = nonce;
  res.json({ nonce });
});

// 2. Check the presentation.
app.post("/auth/prson", async (req, res) => {
  const expectedNonce = req.session.prsonNonce;
  delete req.session.prsonNonce;
  const result = await verifyPresentation(req.body.presentation, {
    expectedAudience: "https://shop.example.com",
    expectedNonce,
  });
  if (!result.ok) return res.status(401).json({ error: result.reason });
  // result.prsonId: the person's ID on your site. result.claims: what they shared.
  req.session.userId = await findOrCreateUser(result.prsonId, result.claims);
  res.json({ ok: true });
});

// Page: signIn({ nonce, required: { uniqueHumanId: true } }) and post result.uniqueHumanId too.
import { verifyUniqueHumanId } from "@prson/login-verifier";

const u = await verifyUniqueHumanId(req.body.uniqueHumanId, { expectedAudience: "shop.example.com" });
if (u.ok) {
  // The same for this person on your site every time, whatever wallet or key they use; unlinkable elsewhere.
  accountKey = req.body.uniqueHumanId.envelope.uniqueIdHash;
}

// Page: signIn({ nonce, notifications: true }) → result.notifications?.handle (when the person said yes)
import { readNotifyHandle, sendNotification } from "@prson/login-verifier";

const handle = readNotifyHandle(req.body.notifications);   // keep it with the account
const sent = await sendNotification({
  apiKey: process.env.PRSON_API_KEY,                         // a key with notify:write
  handle,
  title: "Your order shipped",                              // up to 60 characters
  body: "It arrives Thursday.",                             // up to 180 characters
  url: "https://shop.example.com/orders/1042",              // optional, your sign-in domain only
});
if (!sent.ok && sent.revoked) forgetHandle(handle);         // 410: they turned you off

const { session } = await PrsonLogin.signIn({ nonce });

session.on("claim_updated", (e) => refreshProfile(e.name));
session.on("signed_out", (e) => logOut(e.reason));   // ttl_reached, wallet_signed_out, user_revoked, network_loss, credential_revoked
session.on("credential_revoked", () => logOut("revoked"));

// Sign out from your side:
session.close();