Anyone Can Verify the Authenticity of an ObjectID

Verification can be performed in three ways:

• Using the official website: ObjectID.io
• Using the official ObjectID mobile app
• Manually, by checking the data provided by the ObjectID

Verification via the Official Website: ObjectID.io

By visiting a URL like https://objectid.io/?oid=0x1234..., the verification process for ObjectID 0x1234... is initiated through the ObjectID REST API server.

The server performs the following steps:

• Retrieves the data associated with the specified ObjectID
• Verifies whether the ObjectID was issued by the official ObjectID smart contract. If not, it returns an error
• Extracts the creator’s Decentralized Identifier (DID) and resolves it to obtain the corresponding DID Document. If resolution fails, an error is returned
• From the DID Document, it identifies the linked internet domain and downloads the Domain Linked Verifiable Credential (VC). If the VC cannot be retrieved, an error is returned
• Validates the VC using the standard procedure. If validation fails, an error is returned
• Compares the domain of the product webpage with the domain specified in the VC. If they do not match, the ObjectID is deemed invalid

If all checks are successful, the server returns the verification result and displays the validated data on the website. Otherwise, the ObjectID is flagged as invalid.

Verification via the Official ObjectID Mobile App

The ObjectID mobile app allows users to scan QR codes and validate ObjectIDs without need to trust a tird party server.
It performs the same validation steps described above, independently, without relying on the ObjectID REST API server. In addition to verification, the app provides enhanced features for users who are owners of ObjectIDs, such as management and status updates.

Manual Verification with AI asisstant

Manual verification involves replicating the validation process performed by the ObjectID server. This is suitable for advanced users and developers.

The verification can be done using the IOTA Identity Frameworke api (available here: https://github.com/iotaledger/identity.rs) or, in a more easy way, using an AI assistant.

Example steps:

1. Open the IOTA blockchain explorer at https://explorer.rebased.iota.org/ and insert the ObjectID in the search bar. The site will ask if you want to view it as object. Select the object option.
2. The site will return the ObjectID dataset, including the URL of the product webpage.
3. Extract the domain name from the URL (e.g., http://nxc.technology/)
4. In your browser, open the path:
   http://<domain>/.well-known/did-configuration.json
   For example: http://nxc.technology/.well-known/did-configuration.json
5. You will retrieve a JSON file containing the Domain Linked Verifiable Credential
6. Open the file and copy its content.
7. From the ObjectID dataset in the explorer find the creator_did. This is the identity distributed identifier of the ObjectID creator.
8. Select the last part of the creator_did string, after the semicolon. In example, from did:iota:123:7890… select anc copy 7890….
9. In the IOTA Explorer search bar, paste the copied item (it must be a 64-character string starting with 0x). This will return the DID Document of the ObjectID creator.
10. Select and copy all the content.
11. Visit an AI assistant (such as gemini.google.com or chat.openai.com), paste the content copied from the VC and the content copied from the Did Document, and add this prompt:
    
    Validate the following Domain Linked Verifiable Credential against the provided DID Document. Return only a summary table showing the result of each validation step (DID match, controller match, domain linkage, VC structure. Do no check signature validity). Do not include explanations or any other text—only the table.

You will receive a table like this one:

If all checks are green, the ObjectID has been created by who controls the domain used to publish the related product informations.

Please note that the verification of the DID Document signature has been intentionally skipped. This step is not necessary in the context of the IOTA Identity framework, as DID Documents are created and updated exclusively by the IOTA Identity smart contract. The smart contract ensures that no document can be created or modified unless the provided signature is valid for the associated public key. Therefore, the authenticity of the DID Document is inherently guaranteed.