Developers · Progressive proof

Ask for proof only when a policy needs it

Google zkLogin starts an account. A partner policy determines which additional evidence, if any, is needed.

The boundary that keeps integration simple

1. Account

Google zkLogin creates or opens an Abraxas Passport. It does not establish age, identity, residency, or purchase eligibility.

2. Evidence

Abraxas reuses active evidence when it satisfies the partner policy, then asks only for missing proof. Evidence can expire, be revoked, or require review.

3. Decision

Your app receives a signed decision receipt. It verifies the receipt on its server and gates access from the verified result.

What your integration does

  • Send the holder to /partner/verify with your partner ID, policy ID, and an allowlisted return URL.
  • Receive the callback, then send the receipt ID to your backend.
  • Fetch the public receipt from your backend and validate its decision, signature, current validity, partner, and policy.
  • Grant access only after all checks pass. Treat every missing, expired, revoked, pending, or mismatched proof as not eligible.

Server-side receipt check

Never grant access from callback query parameters alone. Fetch the receipt on your server and fail closed when any check is absent or false.

const receipt = await fetch(
  `${ABRAXAS_ORIGIN}/api/receipts/${receiptId}/public`,
  { cache: "no-store" },
).then((response) => response.json());

const allowed =
  receipt.signature_valid === true &&
  receipt.currently_valid === true &&
  receipt.decision === "approved" &&
  receipt.partner_id === "your-partner-id" &&
  receipt.policy_id === "your-policy-v1";

if (!allowed) return denyAccess();
return grantAccess();

Good Trouble browse example

A browse policy can use an L0 birthday self-attestation and issue a signed browse receipt. That receipt may permit browsing, but it is explicitly valid_for_purchase: false.

A retail policy asks for stronger evidence. The browse receipt cannot unlock retail access because it is bound to the browse policy and has insufficient assurance.

States your product should expect

signed_inThe account exists; no eligibility promise has been made.
proof_neededThe policy needs additional evidence.
pendingEvidence is under review; do not grant access.
eligibleThe required policy proof is active and verified.
deniedThe policy was not satisfied or evidence was revoked.
expiredPreviously held evidence is no longer valid.
errorFail closed and offer a safe retry path.

Privacy by default

  • Partners receive the decision and limited receipt metadata, not raw identity documents, selfies, dates of birth, or addresses.
  • Google sign-in is authentication only. It never substitutes for a regulated proof requirement.
  • A receipt is scoped to its partner and policy. Re-check it before every protected action that requires current eligibility.

Ready to connect a policy? Apply as a design partner →