Affinidi Iota Framework

The Affinidi Iota Framework leverages the OID4VP (OpenID for Verifiable Presentation) standard to request and receive data from Affinidi Vault. The OID4VP is built with the OAuth 2.0 authorisation framework, providing developers with a simple and secure presentation of credentials.

Through the OID4VP standard, the data request is defined using the Presentation Exchange (PEX Query) protocol, which introduces the Presentation Definition parameter. This parameter provides a syntax for defining the required presentation of Verifiable Credentials stored in the user’s Affinidi Vault. Once the user consents to share the requested data, the Affinidi Vault generates the Verifiable Presentation token (VP token) that contains the presentation of Verifiable Credentials.

The same standard and protocol are used in the Affinidi Login to authenticate and authorise users in the application.

Benefits of the Affinidi Iota Framework

Simplified Data Sharing: It streamlines requesting and receiving data from the Affinidi Vault, leveraging the OpenID for Verifiable Presentation (OID4VP) standard. Easily define the Presentation Definition from available templates to request relevant data from the user.

Enhanced User Experience: Simplified data sharing removes manual and repetitive form filling. It enables the reusability of attestable, accurate, and relevant data to get actionable insights about the consumer.

Improved Privacy and User Trust: Consent-driven data sharing promotes transparency and trust, increasing user engagement and loyalty.

How Affinidi Iota Framework Works

To enable your website to request data from the user, you must create an Affinidi Iota Framework configuration to set up the Signing Wallet, JWT Expiration, and the Presentation Definitions required to query the data from the Affinidi Vault.

After creating a configuration, you can integrate the Affinidi Iota Framework into your website with Affinidi TDK. This allows you to request and receive user data from their Affinidi Vault.

sequenceDiagram
    actor U as User
    participant WF as Website<br/>Frontend
    participant WB as Website<br/>Backend
    participant AV as Affinidi Vault
    participant I as Affinidi Iota Framework
    U->>WF: Login
    Note over WF, WB: Authenticates to website via Affinidi Login
    U->>WF: Visits page that requires data
    WF->>WB: Load session protected page
    WB->>WB: Get did from user's session
    WB->>WB: Generate limited token with private key and user's did<br/>[auth-provider]
    WB->>WB: Exchange limited token for Iota credentials<br/>[iota-core]
    WB-->>WF: Page with Iota credentials
    WF->>+I: Initialize Iota session with credentials<br/>[iota-browser]
    I-->>-WF: Iota session
    U->>WF: Clicks on share data button
    Note over U, WF: Triggers a request to <br/>share data from Affinidi Vault
    WF->>+I: New data sharing request<br/>[iota-browser]
    I-->>-WF: Signed request token
    WF->>AV: Open Affinidi Vault with signed request token<br/>[iota-browser]
    WF->>+I: Await data sharing response<br/>[iota-browser]
    AV->>AV: Verify the request token
    AV->>AV: Query stored Verifiable Credentials (VC) using the<br/>presentation definition defined on the Iota configuration
    AV->>+U: Request for consent to share data
    U-->>-AV: Allow access to the data
    AV->>AV: Create a Verifiable Presentation (VP)
    AV->>I: Send VP token
    I->>I: Record the consent given by the user<br/>(Optional from configuration)
    I->>I: Verify the VP token<br/>(Optional from configuration)
    I-->>AV: Ok
    AV->>AV: Window self close
    I-->>-WF: Sends response event with the VP token
    WF-->>U: Provide service

You can provide different context-based data-sharing requests for consumers within their website, requesting different data sets while giving users value in return. The Affinidi Iota Framework enables you to extract actionable insights and provide a better customer experience by offering calls to action at various touch points of the consumer journey.

Affinidi Iota Framework Configuration

When integrating with the Affinidi Iota Framework, developers must create a Configuration first, where they configure the Wallet used for signing the Request Token, the Request Token expiration to enhance security, and Presentation Definitions to query the data from the Affinidi Vault that users will consent to share.

Additionally, developers have the option to enable verification of the credentials shared by the user and store the user’s consent.

The created Configuration ID is required when generating the Iota Credentials to initiate the data request.

Credential Verification

Affinidi Iota Configuration provides an option to enable Credential Verification that sends a Verifiable Presentation token shared by the user to the Credential Verification service to cryptographically verify the credential to check it is tampered-evident and authentic based on the digital signature.

Consent Logs

Developers have the option to enable Consent Logging, which stores the consent provided by the Affinidi Vault user upon consenting to share their data. If enabled, it tracks the user’s DID, including the type of Verifiable Credential they shared, the date the consent was given, and the consent status.

It provides developers proof that the Affinidi Vault user has consented to share their data aside from getting an overview of the number of consents given and what credentials are shared.

Consent Logs can be viewed in the Affinidi Iota Configuration page of the  Affinidi Portal. This page provides the option to Download and filter the logs based on the Affinidi Vault user’s DID.

Scroll down to the bottom of the page to see the Consents panel.

If you wish to get the consent logs stored on your project from your application, you can use the Affinidi Iota Framework client of the Affinidi TDK. Follow this guide to learn how to integrate this.

Test Your Configuration

After creating your configuration, including the Presentation Definition to query data from the user’s Affinidi Vault, you can test your queries to see if it can request data based on your requirements and get a response. This way, even before integration, you can optimise your queries and get the sample response to parse the data correctly into your application and experience first-hand how consent-driven data sharing works with Affinidi Iota Framework.

To test your configuration, click on the Test button available on the overview page of your configuration.

Select the query you want to test and click the Send request button. It will initiate a data-sharing request to your Affinidi Vault and query the data based on the inputs of your Presentation Definition.

Integrate Affinidi Iota Framework

Learn how to integrate with Affinidi Iota Framework to enable secure data sharing flow on your website.