Email Verification API support with SD-JWT for native email verification

[hieuwu]

Summary

As of now, native Android app can get Digital Credential, extract SD-JWT token to perform email verification directly in the app. This brings a lot of convenience over traditional email verification via link sent to email. With this new experience, it would be nice if Supabase can support some mechanism to set up and an API to verify email with SD-JWT.

Limitation

No direct support from API so can not build a robust end-to-end solution from SDK
This new SD-JWT has nothing to do with OIDC so can not take advantage of any current Auth API

Work around solution

We can achieve the whole flow with Edge Function, but it requires complex set up and not developer-friendly. Below is my solution built with supabase-kt.

High level

sequenceDiagram
    participant App as Android App
    participant CM as Credentials Manager
    participant EF as Edge Function
    participant Google as Google Identity Services

    App->>CM: 1. Request Digital Credentials
    CM-->>App: 2. Return Digital Credentials (SD-JWT)

    App->>App: 3. Extract SD-JWT Token

    App->>EF: 4. Send SD-JWT Token

    EF->>Google: 5. Validate Issuer + Signature
    Google-->>EF: Validation Result

    alt Validation Successful
        EF->>EF: 6. Update Email Verification Status
        EF-->>App: Success Response
    else Validation Failed
        EF-->>App: Error Response
    end

    Note over App,Google: High-level Email Verification Flow using Google Digital Credentials

Loading

Screenshot

Email.verification.mp4

Implementation of sd-jwt token extract from Android
supabase-community/supabase-kt-plugins#96

Send the token to Edge Function
supabase-community/supabase-kt#1316

Reference

Implement email verification with the Digital Credentials API
OpenID for Verifiable Presentations 1.0
SD-JWT Implementation in JS (TypeScript)

[harrysun2006]

Interesting one — SD-JWT / Digital Credentials-based email verification is pretty forward-looking, and you're right that it doesn't map onto the existing OIDC-based auth paths, so there's no native hook for it today.

The Edge Function approach you've built (receive the SD-JWT, validate issuer + signature against Google, then flip the verification status) is genuinely the correct pattern for now — it's how you'd integrate any auth mechanism GoTrue doesn't natively understand. The rough edge is exactly what you called out: you have to reach into the user's verification state yourself, which means using the Admin API (auth.admin.updateUserById with email_confirm: true) from the function with the service role, plus your own nonce/replay protection. Doable, but not the "drop-in" experience a first-class API would give.

For it to become native, GoTrue would need a verification endpoint that accepts an SD-JWT presentation and does the issuer/signature/selective-disclosure validation server-side — that's a real feature, not a config toggle, so this is right to raise as a Feature Request. I'd keep the writeup (the sequence diagram especially) attached, since it gives the team a concrete flow to react to, and let it gather upvotes. If you want, sharing your working supabase-kt + Edge Function solution in the thread would also help others who need this before any native support lands.

[hieuwu]

@harrysun2006 Thank you for the detailed feedback. Let me know if you need to experiment further. I'm trying to achieve the same for iOS and will update here soon.

Just put again my implementation to get SD-JWT with Google Credentials Manager and verify with Edge Function with supabase-kt and demo app:

Implementation of sd-jwt token extract from Android for email verification
supabase-community/supabase-kt-plugins#96

Demonstration with Edge Function
supabase-community/supabase-kt#1316

[harrysun2006]

Thanks for sharing the implementation, @hieuwu — and honestly, real credit to you here. Proposing a forward-looking feature and building a working Android + Edge Function reference for it is exactly what turns a "someday maybe" request into something the team and everyone hitting the same need can actually evaluate. The iOS write-up will be a great addition whenever it's ready — I'll keep an eye out for the update. Appreciate the effort you've put into this. 🙌