Skip to main content
Verifiable credentials on Moca Network are designed to be tamper-evident, privacy-preserving, and portable across any verifier in the ecosystem.

​
Issuance integrity

When a credential is issued:
  1. The issuer signs the credential data with their DID (Decentralized Identifier).
  2. A cryptographic proof of the credential is generated and submitted to Moca Chain.
  3. The credential is written to on-chain storage. The vcStatus transitions from WAIT_ONCHAIN to ONCHAIN once confirmed.
The on-chain proof acts as a tamper seal. If the credential data is modified after issuance, any verification attempt will fail because the proof no longer matches.

​
Zero-knowledge verification

By default, credential verification uses zero-knowledge proofs (ZKPs). This means:
  • The verifier asks a question: “Does this user hold a valid credential matching schema X?”
  • The user’s device generates a ZK proof that answers “yes” or “no” without revealing the underlying data.
  • The verifier receives the boolean result and the on-chain proof hash — nothing else.
No PII is transmitted during verification. The verifier cannot reconstruct the original credential data from the proof.

​
Selective disclosure

ZK proofs can verify individual attributes without revealing the full credential. For example, a credential containing age, country, and kycLevel can prove that kycLevel >= 2 without revealing the user’s age or country. Selective disclosure is defined at the schema and verification program level. See Schema Design for configuration.

​
Credential revocation

Issuers can revoke credentials at any time. Revocation is recorded on-chain and takes effect immediately — any subsequent verification against a revoked credential will fail. When using Issue on Behalf with onDuplicate: "revoke", the old credential is automatically revoked before the new one is issued.

​
Regulated data access (CAK)

For industries where verifiers must access raw data (e.g. identity photos for KYC), the Compliance Access Key (CAK) framework adds a consent-gated encryption layer. Data is encrypted at issuance and only decryptable by a verifier who has obtained explicit user consent.

​
Credential storage

Storage layerWhat is storedEncrypted?
Moca Chain (on-chain)Credential proofs and state anchorsN/A — proofs are hashes, not data
dStorage (decentralized)Full credential payloadYes, if CAK is enabled
User devicePrivate keys, session tokensYes, managed by MPC shards

​
Further reading