ThunderID is an open source IAM stack built from scratch for AI agents, post-quantum security, and decentralized identity, with a lightweight Go runtime and GitOps support. One of its four foundational pillars is decentralized identity: digital wallets, verifiable credentials, and DIDs.
An early priority for us is closing the gap between application development and existing decentralized identity infrastructure. Developers shouldn't have to become DID or verifiable credential specialists to use them, especially those building citizen-facing or public-sector applications. Adding decentralized identity capabilities to an app should be as straightforward as adding any other identity feature, so teams can build directly on that infrastructure instead of around it.
CitizenVerify is a demo application built for the EUDI Wallet Hackathon 2026. We entered as team Ctrl Alt Verify and won the Public Sector Track. CitizenVerify enables citizens to verify the authority of public officials using verifiable credentials and digital wallets, with ThunderID powering both credential issuance and verification end to end.
What we built
Picture this. It's 11 p.m. There's a knock at your door. Someone shows a badge and says they're from the police, here to conduct a drug search.
Would you just let them in?
They have a badge. But are they authorized to conduct that search right now? Are they even real police officers? You have no way to check. So you do what most people do: you let them in and hope for the best.
This isn't a rare edge case. A gas technician needs access to your building. A bailiff arrives with a court order. A health inspector shows up unannounced. It happens constantly, and every time, citizens are expected to just trust.
You've probably felt that moment at the door: no real way to verify, just a gut feeling and a hope that the badge is real. CitizenVerify removes that guesswork.
How CitizenVerify works
You open the CitizenVerify website or mobile app, find the type of authority you need to check, and tap it: police officer, gas technician, bailiff. The app generates a QR code on the spot.
You show that code to the person at your door. They scan it with their EUDI Wallet, review what is being requested, and consent to share their authority credential.
Your screen then shows the result: who they are, what authority they hold, and the details of what they are permitted to do. You can compare the verified details on your screen against the person in front of you. No hotline call. No squinting at a badge. A scan and a straight answer.
If a verification fails, a silent alert can fire to a trusted contact along with your location. You don't have to say anything. Someone simply knows.
That is one layer. The same infrastructure extends further: a full audit trail of every official interaction at your address, the same protection for landlords, hospitals, and schools, cross-border checks when an EU official turns up where they shouldn't, and the same trust model applied to digital interactions rather than physical ones.
Our team Ctrl Alt Verify built CitizenVerify for the EUDI Wallet Hackathon 2026, and won the Public Sector Track. As one of the winning teams, we presented CitizenVerify at the EUDI ON 2026 Community Event in Berlin, to an audience of digital identity experts, government representatives, and industry leaders.
What happens behind the scenes
The idea: authority as a credential
The central idea behind CitizenVerify is simple. Authority can be represented as a credential.
Traditional identification proves identity. A badge might tell you who someone claims to be, but it says little about what they are authorized to do. CitizenVerify encodes the authority itself as a verifiable credential. These credentials carry structured capability claims, so the credential proves delegated authority, not just identity.
The solution is envisioned around a government-operated trust framework aligned with eIDAS 2.0 and national trust infrastructure. Only issuers registered within that framework are recognized, and only registered relying parties can request presentations.
Two things happen behind the scenes, and ThunderID drives both: issuing the credential, and verifying it.
Issuance. A government body, say the police department, grants an officer an authority credential through ThunderID, using OpenID4VCI, the issuance protocol of the EUDI Wallet ecosystem. The officer authenticates, consents, and the signed credential is delivered to their EUDI Wallet, cryptographically bound to them. Behind this sits the government-operated trust framework: only issuers registered within it are recognized, so a credential is only as good as the institution standing behind it. If the officer's authority is later suspended or revoked, the issuer updates a status list, and every future verification reflects it.
Verification. When the officer arrives at your door, CitizenVerify shows you a QR code. The trust runs both ways: the request behind that code is signed by ThunderID as a relying party registered in the same trust framework, so the officer's wallet knows it's talking to a legitimate verifier before sharing anything.
The officer scans, consents, and their wallet returns a signed presentation over OpenID4VP. ThunderID then verifies it end to end: is the credential genuine, does it belong to this wallet, is the issuer registered and trusted, has the authority been revoked, and does it hold here and now, within this jurisdiction, at this time? In effect, ThunderID walks the whole chain from the institution registered in the trust framework down to the individual standing at your door.
Trust is never assumed. It is verified each time.
ThunderID then translates the outcome into a plain answer a citizen can read at a glance. The complexity stays under the hood.
How ThunderID simplifies wallet-based application development
Building wallet-enabled applications today often means learning an entirely new identity stack. Developers need to understand verifiable credentials, OpenID4VCI, OpenID4VP, trust registries, presentation queries, cryptographic proofs, and evolving standards before they can build even a simple application.
Building CitizenVerify reinforced just how much of that complexity sits below the surface. The application itself is conceptually simple. The difficult part isn't the user experience, it's implementing the wallet protocols, managing trust, validating cryptographic proofs, handling selective disclosure, and keeping pace with evolving standards.
That experience shaped how ThunderID is built. Instead of requiring every application to implement these building blocks, ThunderID provides them as platform capabilities. For CitizenVerify, ThunderID handled both sides of the credential lifecycle: on the issuance side, credential offers, wallet interactions, and binding credentials to authorized officials; on the verification side, QR-code generation, signed presentation requests, presentation verification, issuer trust validation, key binding, and policy enforcement. The application simply requested an issuance or a verification and focused on presenting the result to the user.
Most of the work is configuration rather than code. Credential types, presentation requirements, and trust policies are defined declaratively, while ThunderID executes the OpenID4VCI and OpenID4VP flows, validates cryptographic proofs, and enforces trust and privacy behind the scenes. As a result, developers spend their time building applications instead of implementing decentralized identity protocols.
Whether you're issuing professional credentials, verifying public officials, authorizing AI agents, or enabling cross-border trust, the underlying infrastructure should already be there.
Want to see it in action? Try the CitizenVerify demo yourself, and check the ThunderID docs on wallet-based credential issuance and verification to see how to build the same flow into your own application.
Thisara Welmilla
ThunderID Team Member
