XProduct

Passport seal

Check a passport seal

Every passport that xProduct gives out in the standard format (EN 18223) carries a digital seal. It proves the data came from xProduct and has not been changed since, also for a copy someone saved months ago. The check runs in your own browser, with our public keys.

A passport on this site

Its product number, or its passport address.

A signed passport file

A .jws file, e.g. from /api/dpp/{number}/en18223/signed.

What the seal is

  • A JSON Web Signature (RFC 7515) with ES256 (ECDSA, P-256, SHA-256), made with a key that never leaves our key vault.
  • Every standard answer (/api/dpp/{id}/en18223 and /api/v1/…) carries it in the X-DPP-Signature header, without the data (detached). /api/dpp/{id}/en18223/signed gives the passport and seal as one file.
  • The public keys are at /.well-known/jwks.json; the seal's kid names the key. Older keys stay listed, so older copies can still be checked.
  • It is xProduct's seal, made for the economic operator named in the passport. The operator's own electronic seal, with a certificate recognised in the EU, is a later step that waits on EU rules.

Checking it with your own software

  1. Take the seal from the header: header..signature (nothing between the two dots).
  2. Put the answer's body, exactly as received and base64url-encoded, between the dots.
  3. Verify it as a normal ES256 JWS with the key from the key set whose kid matches. Any JOSE library can do this.