Credential Handler API polyfill _(credential-handler-polyfill)_

> Credential Handler API (CHAPI) polyfill for browsers

The CHAPI polyfill provides a number of features that enable the issuance,
holding, presentation, and general management of Verifiable Credentials,
Authorization Capabilities, and a variety of other cross-origin credentials.

For more information on CHAPI and links to updated demos and a playground, check out
chapi.io!

!Animation showing selection of Credential Handler

See the feature videos for more animations of CHAPI in action.

Table of Contents

- Background
- Demo
- Usage
- Install
- Feature Videos
- Security
- Contribute
- Commercial Support
- License

Background

Credential Handler API (CHAPI) is:

* a browser API
* lets web apps securely get() and store() credentials, without
having to roll their own wallet infrastructure
* provides a secure _trusted UI_ for users to manage those credentials
* gives users ability to choose service providers for wallets

Read more: CHAPI Motivation and Background.

Demo

Take a look at the following websites to try out a minimal CHAPI implementation:

1. https://wallet.example.chapi.io
2. https://issuer.example.chapi.io
2. https://verifier.example.chapi.io

Usage

$3

Before you can get and store credentials, you need to load the
polyfill library.

If you're loading the polyfill from a
`

$3

To install as a dependency of another project, add this to your package.json:

`
"credential-handler-polyfill": "^3.0.0"
`

If you plan to develop or modify this polyfill, install it from Github:

`
git clone https://github.com/credential-handler/credential-handler-polyfill.git
cd credential-handler-polyfill
npm install
`

Features

The CHAPI polyfill provides a number of features that enable the issuance,
holding, presentation, and general management of Verifiable Credentials,
Authorization Capabilities, and a variety of other cross-origin credentials.

$3

You can add a Credential Handler by calling the
CredentialManager.requestPermission() API. This call will ensure that the
individual using the browser explicitly confirms that they want to use the
website as a credential handler. *This call must be called immediately
following a user interaction, such as a button click or tap in order to
ensure that the permission prompt can be shown to the user.*

!Animation showing addition of a Credential Handler

$3

CHAPI supports storing credentials via the navigator.credentials.store() API.
Storage of credentials prompts the individual using the browser to confirm
that they want to store the credential in their digital wallet.

!Animation showing storage of Credentials

$3

CHAPI supports the presentation of credentials via the
navigator.credentials.get()` API. CHAPI is agnostic to the presentation
request query language and passes the query directly through to the credential
handler. When presenting credentials, the individual is shown what they will
be sharing and must provide explicit consent before the credentials are
shared with the requesting party.

!Animation showing request for a Credential

$3

Multiple credential handlers may be registered. If an individual has multiple
credential handlers registered, they are given the option of selecting between
the handlers or setting one as the default on a per-website basis.

!Animation showing selection of Credential Handler

$3

When an individual desires to not use a credential handler anymore, they can
hide that credential handler via the interface. If they accidentally click
the hide button, they have several seconds to undo the action. Credential
Handlers that are hidden can be added again by going to the registration
website.

!Animation showing hiding of Credential Handler

$3

If an individual has no credential handlers registered, the website that
uses CHAPI can suggest up to three credential handlers that can be
"just in time" installed so that the original storage operation can
complete.

!Animation showing Just-In-Time Addition of Credential Handler

$3

CHAPI is designed to run on desktop, tablet, and mobile form factors. The
interface is responsive to provide the best experience for each form factor.

!Animation showing Credential Handler working on Mobile

Security

This polyfill makes use of a UI that emulates secure browser UI (also known as
"browser chrome"). This polyfill UI is an emulation and IS NOT implemented by
the browser. Support for the
Credential Handler API
could make this UI (or most likely a much better one!) a reality in browsers in
the future.

Contribute

See the contribute file!

PRs accepted.

Note: If editing the README, please conform to the
standard-readme specification.

Commercial Support

Commercial support for this library is available upon request from
Digital Bazaar: support@digitalbazaar.com

License

New BSD License (3-clause) © Digital Bazaar