Skip to main content
The Compliance Access Key (CAK) is an optional encryption framework that enables regulated data usage without platform-level custody, key escrow, or implicit trust assumptions. When enabled, sensitive user data is encrypted during credential issuance and can only be decrypted by a Verifier who has obtained explicit user consent.
CAK is optional. If your credentials do not contain raw PII or biometric data, or if verifiers only need zero-knowledge proof results, the standard AIR Kit flow is sufficient.

​
When to use CAK

​
Three-phase lifecycle

CAK operates across the entire credential lifecycle: configuration, issuance, and verification.

​
Phase 1: Dashboard configuration

Before any credentials are issued, administrators configure the CAK rules in the Developer Dashboard.

​
Issuer setup

  1. Enable CAK on a Pricing Schema — This is the top-level switch. Only pricing schemas with CAK enabled can produce CAK-encrypted credentials.
  2. Enable CAK on an Issuance Program — When enabled, the Issuance SDK will generate a CAK key pair during issuance and return the public key to your system for encryption.
  3. Configure a Global Callback URL — Set an HTTPS endpoint via POST /issuer/modify (pass callbackUrl). This endpoint receives authorization notifications whenever a Verifier is granted access to your users’ data.

​
Verifier setup

  1. Require CAK for a Verification Program — When enabled, only CAK-encrypted credentials are accepted and the user consent flow is mandatory.
  2. Select Issuers — If your verification program requires CAK, the system only shows Issuers that have enabled the CAK feature.
For step-by-step configuration instructions, see the Issuer guide and Verifier guide.

​
Phase 2: Credential issuance

When CAK is enabled for an issuance program, the issueCredential() SDK call includes additional encryption steps. The issueCredential() response includes a cakPublicKey field when CAK is enabled. See Issuing Credentials for the SDK reference.

​
Phase 3: Verification and authorization

When a user presents a CAK-encrypted credential to a Verifier, the process includes a consent step and a two-stage decryption. The verifyCredential() response includes a cakPrivateKey field when the result is "Compliant" and CAK is enabled. See Verifying Credentials for the SDK reference.
The CAK private key must be used in-memory only. Never persist it to disk, database, or logs.

​
Platform responsibilities

The AIR Credential platform provides the following CAK capabilities:

​
Cryptographic details

​
Next steps

Issuer integration

Dashboard configuration, SDK integration, encryption workflow, and callback endpoint implementation.

Verifier integration

Verification setup, user consent flow, decryption workflow, and security best practices.