tw-web-app is a management console for Triveria digital identity wallets. Each wallet is a self-sovereign identity node that can act as a credential holder, issuer, verifier — or all three simultaneously.

The platform handles the full credential lifecycle: defining credential schemas, issuing signed Verifiable Credentials via OpenID4VCI, verifying them via OpenID4VP, and managing trust framework membership (EBSI, IDTL). Trust can be also anchored through ETSI Trusted Lists and X.509 certificate chains.

An identity is a wallet instance with a DID, a trust framework configuration, and one or more capability roles.

• —

  holder — receives and stores credentials issued by others

• —

  issuer — creates and signs Verifiable Credentials

• —

  verifier — requests and validates credential presentations

Wallets are created from identity templates or configured from scratch. Each wallet has a unique DID, an optional X.509 certificate, and a configurable set of trusted issuers and verifiers.

Trust is established at two complementary layers. The trust framework layer (EBSI, IDTL) defines who is authorised to issue which credential types through on-chain or registry-based accreditation. The PKI layer anchors issuer identity to verifiable certificate chains rooted in ETSI Trusted Lists — the same infrastructure used by eIDAS-compliant services across the EU.

• —

  EBSI — European Blockchain Services Infrastructure; roles registered on-chain (RTAO → TAO → TI)

• —

  IDTL — IDunion Trust List; registry-based participant accreditation

• —

  ETSI Trusted List — EU-standardised list of trust service providers; root of X.509 PKI trust

• —

  X.509 cert chain — wallet certificate signed by a TSP, used for PDF signing and issuer identity

Issuers create Verifiable Credential drafts from a credential type schema. The offer flow produces a scannable QR code and a shareable URL that the holder's wallet consumes over OpenID4VCI.

• —

  credential draft form — structured subject-claim input

• —

  QR code + URL — scan-to-claim for mobile wallets

• —

  PDF twin — X.509-signed PDF companion generated alongside the VC

• —

  revocation — mark issued credentials invalid at any time

• —

  status tracking — draft → valid → invalid lifecycle

Credential types that opt into PDF twins (hasPdfTwin: true) produce a signed PDF document at issuance time. The PDF is generated from the credential subject data, signed with the issuing wallet's X.509 certificate, and stored alongside the VC. It can be downloaded from the credential detail view at any time — serving as a human-readable, legally recognisable companion to the machine-readable VC.

The credential form shows an info alert when both conditions are met (PDF twin support + X.509 installed), confirming that the PDF will be generated. If the X.509 certificate is absent, a warning is shown instead and the VC is still created without a PDF twin.

Verifiers initiate a presentation request that produces a URL and QR code. The holder scans the code, selects matching credentials, and submits a Verifiable Presentation. Results are recorded and surfaced on the dashboard.

• —

  presentation request URL + QR code

• —

  real-time polling — auto-detects VpVerified / VpInvalid events

• —

  holder DID match check — confirms subject == presenter

• —

  verification history — persisted per owner in DynamoDB

Holders open a verifier URL and select which credentials to share. The UI shows each matching credential with its type icon and the exact fields the verifier requested — checkboxes are unchecked by default, so consent is explicit.

• —

  fieldsToDisclose list per credential

• —

  explicit opt-in selection — no pre-checked credentials

• —

  clear no-match message when wallet holds no suitable credentials

Wallets configured with the EBSI trust framework can be onboarded to the European Blockchain Services Infrastructure through a guided wizard. Two networks are supported.

• —

  conformance — automated credential fetch from EBSI issuer mock

• —

  pilot — JWT import for credentials issued by EBSI support

• —

  roles — RTAO → TAO → TI accreditation chain

• —

  DID Registry — blockchain transaction + polling confirmation

• —

  TIR status — real-time role display (RTAO / TAO / TI chips)

• —

  controlling wallets — Authorize & Accredit, Revoke Accreditation

• —

  X.509 bridge — TI wallets acquire a PKI certificate via OID credential flow

EBSI Trusted Issuer (TI) wallets can acquire an X.509 certificate through the OID credential flow. A CSR is generated (with the wallet DID embedded as a Subject Alternative Name when applicable), submitted to a certificate authority via either a WMP invite URL or a Credential Offer URL, and the resulting certificate is extracted from the accepted credential and installed on the wallet.

This creates a bridge between EBSI blockchain identity and X.509 PKI identity: the same wallet that holds a TIR-accredited EBSI DID can also sign PDF credential twins with a certificate rooted in an ETSI-recognised trust anchor — satisfying both on-chain trust framework requirements and traditional PKI-based verification.

Reusable definitions shared across wallets. Accessed from the Building Blocks page in the left navigation.

• —

  identity templates — full wallet configurations saved as reusable presets

• —

  credential types — schema + display definition for each VC type

• —

  built-in catalog — bundled templates for EBSI, IDTL, and generic use cases

An AI chat panel scoped to the open wallet, built on assistant-ui. Answers questions about configuration, credentials, and trust framework context in plain language, reading live data through MCP tools. Anything that changes state requires explicit user confirmation before the call is made.

• —

  "what credentials can I issue?"

• —

  "start a verification for the university verifier"

• —

  live MCP tool calls shown inline as they run

• —

  approval card before every state change

• —

  Anthropic, OpenAI, Google or Bedrock — configured per account

The home screen. Lists all wallets, supports bookmarking for quick access, and shows cross-wallet credential and verification history in collapsible panels.

• —

  bookmarks — pin frequently used wallets to the top

• —

  search — live filter across all identities

• —

  my credentials — held credentials across all wallets

• —

  issued credentials — credentials issued across all wallets

• —

  verification results — recorded VpVerified / VpInvalid events

• —

  build with AI — opens the use-case wizard for guided setup