Skip to main content

IA Attestation (Kind 35522)

A kind 35522 IA Attestation is an Identity Authority's signed statement: "Nostr key X owns web identity account Y." Users point to it from their Identity Connection (kind 35521).

The full definition — tags, the evidence format, the npv1 challenge token and cross-IA re-verification — is in NIP-IC.

Example (as Zapf's IA issues it)​

{
  "kind": 35522,
  "content": "",
  "tags": [
    ["d", "<ConnectionKey>"],
    ["p", "<user_pubkey>"],
    ["platform", "discord"],
    ["evidence", "{\"version\":1,\"platform\":\"discord\",\"auth_type\":\"public_post\",\"user_id\":\"1254093577051574374\",\"username\":\"joyosar\",\"verified_at\":1779219590,\"evidence_url\":\"https://discord.com/channels/.../1506380827804831834\",\"challenge\":\"npv11qqsykd7ufyvfjl9qasdgtrz02jsv97l9atdnqc0vz8wsytxqxn9v6pqzvtph4\",\"pre_auth_code\":\"feb7dee63337\"}"],
    ["expiration", "<unix_timestamp>"]
  ],
  "pubkey": "<ia_pubkey>",
  "created_at": 1709424000,
  "id": "...",
  "sig": "..."
}

Zapf's IA verifies by public post: the user posts an npv1 challenge token, and the evidence records where. Anyone can fetch evidence_url and re-check it, which is what makes Evidence Sharing work. Other IAs may verify differently (for example with a code sent to an email address); those attestations rest on the IA's signature alone and can't be re-checked by another IA.

Zapf's attestations expire after 90 days by default (IA_ATTESTATION_EXPIRY_DAYS).

Lifecycle in Zapf​

  1. The user completes verification; Zapf's IA signs and publishes the 35522.
  2. The user's client publishes a 35521 pointing to it.
  3. The client then tells Zapf the connection is live. Only now does Zapf start routing payments for that account to the user.
  4. If the account is verified again — by the same user or a new one — Zapf publishes a new 35522 that replaces the old one; the current owner republishes their 35521.
  5. To revoke, Zapf publishes a kind 5 deletion of the 35522.