> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sumvin.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verifier Guide

> How merchants and service providers verify Sumvin identity credentials

If you're a merchant, service provider, or any system that receives Sumvin identity credentials — this guide is for you. As a **verifier**, you don't call the Sumvin API to create users or sign authorisations. Instead, you **receive and verify** credentials that arrive as HTTP headers on incoming requests. **You don't store the identity. You check it at the door. Every credential is anchored to a <Tooltip headline="Stamped Mandate" tip="A signed authorisation a user grants for specific scoped actions — delivered on the wire as a PINT." cta="Glossary →" href="/glossary">Stamped Mandate</Tooltip> — the cryptographic authorisation the user signed.**

<Snippet file="product-term-disambiguation.mdx" />

A Stamped Mandate is delivered over the API as a `PINT` (header `x-sumvin-pint-token`). The product name and the wire artifact describe the same thing — read "Stamped Mandate" wherever you see a `PINT` in the headers and code below.

## What You Receive

When a Sumvin user (or their AI agent) interacts with your service, the request includes identity credentials as HTTP headers. Depending on the [verification tier](/merchant/verification-tiers), you receive either:

**Standard tier (Stamped Mandate JWT only):**

```http theme={null}
x-sumvin-pint-token: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...
```

**Enhanced tier (Stamped Mandate JWT + signature):**

```http theme={null}
x-sumvin-pint-token: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9...
X-Pint-Signature: 0x...
X-Pint-Payload: eyJ3YWxsZXQiOiIweEUyM2M5QTcwQkM3NDlFQmRkZDhj...
```

<Note>
  The `x-sumvin-pint-token` header carries the raw JWT (no `Bearer` prefix). Reserve the `Authorization: Bearer` header for **outbound** calls you make to SIS using your SIS API key (for example, revocation checks or token exchange).
</Note>

## What You Need to Verify

At minimum, every verifier should:

1. **Validate the JWT signature** against the SIS public keys ([<Tooltip headline="JWKS" tip="JSON Web Key Set — the public-key document used to validate PINT JWTs." cta="Glossary →" href="/glossary">JWKS</Tooltip>](/merchant/jwks))
2. **Check the `aud` claim** matches your registered identifier
3. **Check the `exp` claim** to confirm the JWT hasn't expired
4. **Optionally check revocation** via the [status endpoint](/merchant/revocation)

For enhanced-tier requests, you additionally verify the Stamped Mandate's EIP-712 signature — see [Verifying PINT Signatures](/merchant/verify-pint-signature).

## What You Need

| Requirement                         | How to Get It                                                                                |
| ----------------------------------- | -------------------------------------------------------------------------------------------- |
| Your registered audience identifier | Provided during partner onboarding                                                           |
| SIS JWKS endpoint URL               | `https://sis.sumvin.com/v0/sis/.well-known/jwks.json`                                        |
| A JWT verification library          | Any standard JWT library (e.g., `jose`, `PyJWT`, `jsonwebtoken`)                             |
| SIS API key (optional)              | Only needed if you want to call the revocation check endpoint. Contact your account manager. |

<Info>
  You do **not** need an API key to verify JWT signatures. The JWKS endpoint is publicly accessible. An API key is only required to call the revocation check endpoint.
</Info>

## Start verifying

The fastest path to a working verifier is the [Verify a standard-tier Stamped Mandate](/merchant/quickstarts/verify-standard-pint) quickstart — five minutes from zero to a decoded, signature-verified JWT payload printed to stdout. Start there, then come back to the deeper reference pages below when you need to handle enhanced-tier requests or agent-signed mandates.

## Next Steps

The fastest path is the [standard-tier quickstart](/merchant/quickstarts/verify-standard-pint) — five minutes from zero to a decoded, signature-verified JWT. From there, [verification tiers](/merchant/verification-tiers) tells you when Standard is enough and when you need Enhanced, [verify a JWT](/merchant/verify-jwt) is the full step-by-step reference, and the [header reference](/merchant/headers) lists every identity-related HTTP header you'll meet at the boundary. **Everything else is detail — the shape of the credential, and the shape of your check against it.**

These two tiers are the [Sigil verification tiers — Standard and Enhanced](/merchant/verification-tiers).