Demos
Everything below runs on a live OTCP demo instance: an issuer, a verifier, a status service, a Trust Fabric and a public directory, plus demo businesses built on top of them. Real services and real cryptography, demo-grade data. Some scenarios need the OTCP wallet on a phone; the rest run in your browser.
Play a scenario
Fictional businesses, live rails. Each one exercises a different part of the trust layer.
The Vault is an 18+ venue. Its door screen asks one question: over 18? Scan its QR with the OTCP wallet, approve one line, and the screen goes green. The Vault learns one signed "yes": no birthday, no name, no document.
At NueBank, open an account with the identity already in your wallet. OTCP checked who you are once; NueBank asks for your name, that completed KYC and a sanctions screening from the last 30 days, and never sees a document. Its second factor is the wallet's Auth tab, working like any authenticator app.
At Remitix, money a friend sent you waits until your own wallet proves who you are. Small amounts need a completed KYC and a recent sanctions screening; from 100 USD you also share your name. One person on one phone, or scan from a computer.
Tessera is a workspace with no password to steal. Signing in is a challenge your wallet signs with a key only your fingerprint can release — scan a QR from a computer, or tap once on the phone. Sign in twice and it knows you, having stored no password, no email and nothing another site could recognise.
Click through the consumer wallet with no install: credential home, OTCP ID, selective-disclosure shutters and mandates to AI agents. It shows an earlier design of the wallet.
Give an assistant such as Claude a permission from your wallet: what it may buy, up to how much, and above what it must ask you first. It pays inside those limits, asks you in the wallet when it needs more, and stops the moment you revoke it. It runs today through OTCP's connector for hosted assistants, with the OTCP wallet.
Under the hood
The same endpoints the demo businesses call, open for you to inspect and integrate against.
Play the merchant. Pick exactly which claims to request, "Over 18" with no date of birth, or selected identity fields, then scan the QR with a wallet and watch a real OpenID4VP presentation verify in seconds. Selective disclosure, end to end.
Every issuer and verifier on the demo instance, as the Trust Fabric publishes them: accreditations, intended uses, trust marks. A verifier trusts by resolving these statements, never a list on a page.
The OID4VCI issuer that turns a completed KYC into a reusable OTCP ID, issued as an SD-JWT VC bound to the holder's device key.
The IETF Token Status List that lets any verifier check, in real time, whether a credential, or a delegation, is still valid.
The public draft of the delegation credential profile: authority classes, attenuation, revocation cascade, and the verification walk.
These are real services, not mockups. The issuer, verifier, status service, Trust Fabric, blueprints service, console and demo apps run on Google Cloud Run with managed TLS, each on its own subdomain, so you can integrate against them directly. The businesses are fictional and the data is demo-grade; harden before production use.
