Web proof verification
The default Vouch verification mode — proof that a response came unmodified from the platform, during the user's own logged-in session.
Most Vouch verifications use this mode. verificationMethod defaults to "web-proof", so there is nothing to set.
What the user does
Opens the verification link
In the Vouch Verifier extension, the Vouch mobile app, or your own app via the mobile SDK.
Signs in to the platform
Directly with the platform, exactly as they normally would. Vouch never sees the credentials.
Confirms what will be shared
They see the specific facts the data source will extract before anything is sent.
Returns to you
The proof is checked, the facts are extracted, and the result is posted to your webhook.
What you receive
The same payload shape as every other Vouch verification: a requestId, the outputs the data source defines, and a webProofs array carrying the evidence.
{
"requestId": "…",
"verificationMethod": "web-proof",
"outputs": { /* the facts you asked for */ },
"webProofs": [
{
"outputs": { /* extracted from this proof */ },
"presentationJson": { /* the evidence, re-verifiable by anyone */ },
"decodedTranscript": { /* human-readable request and response */ }
}
]
}You do not have to do anything with webProofs. Vouch checks every proof before the webhook is sent, so the outputs are already trustworthy. The evidence is there for the cases where you need to audit a result later, or let a third party confirm it independently. Receiving and verifying results covers both.
webProofs is omitted when a data source handles sensitive data. Only the extracted outputs are retained in that case.
What makes it trustworthy
Vouch uses zkTLS and confidential computing to attest the platform's response. The user's session is not replayed, simulated or scraped: the proof is made from the live connection between the user and the platform, so a doctored screenshot or an edited response cannot pass.
That machinery runs underneath the product. You consume a normal data API and never operate any of it, and your users need nothing beyond their own account.
When a source uses video instead
Some things a user can clearly demonstrate on screen cannot be captured as a web proof. Those sources use video verification instead, where the Vouch app screen-records the session and an AI verifier returns the same structured outputs.
This is decided per data source when the source is built, not per request. The catalog marks which mode a source uses, and passing verificationMethod: "video" to a source that does not support it is rejected.
Both modes return the same thing. The outputs schema, the webhook, redirectBackUrl and requestId are identical, so one webhook handler covers both.
Last updated on