demo · v133

Age gate flow — selective disclosure

The motivating use case the W3C explainer leads with: an online liquor retailer asks the user's wallet to prove only age_over_21 — not name, not DOB, not address. navigator.credentials.get({ digital }) brokers the request; the wallet picks which credential satisfies it.

Behind a flag: chrome://flags/#web-identity-digital-credentials or origin trial. Without a wallet registered for ISO mDL, the call will reject. The demo logs the actual response.

checkout — case of stout

3 × Imperial Stout, 500ml£12.50
shipping (next day)£4.99
total£17.49

age verification required. we request only age_over_21 from your wallet.

not yet requested

why selective disclosure

The 2020s "upload a photo of your ID" flow over-collects: the retailer gets the user's name, photograph, address, and DOB just to learn one bit. The Digital Credentials API + ISO mDL together support selective disclosure — the verifier asks for a single attribute, the wallet signs only that attribute, and the user sees the request in OS UI before approving. The site never learns the underlying date of birth. Click the second button for the contrast: requesting the full mDL prompts the user about giving up everything.

// Selective disclosure: just one bit
await navigator.credentials.get({
  digital: {
    providers: [{
      protocol: "mdoc-api",
      request: {
        docType: "org.iso.18013.5.1.mDL",
        elementIds: ["age_over_21"]   // <-- only this
      }
    }]
  }
});

see also