verified-email

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: critical finding, no behavioural pass, undeclared transfer.

To request a verified email, construct a [`GetCredentialRequest`](https://developer.android.com/reference/android/credentials/GetCredentialRequest)

> **Note:** If `email_verified` is `true` and `hd` is empty in the response, it implies that the account is an authorized Google Account. Google does not issue [verifiable credentials](references/andr

> **Warning:** From August 2026, the [response JSON](https://developer.android.com/reference/androidx/credentials/DigitalCredential#getCredentialJson()) format has been updated to strictly match the W

> **Warning:** As mentioned in [Parse the response on the client](#parse-response), from August 2026, the [response JSON](https://developer.android.com/reference/androidx/credentials/DigitalCredential

// Send the raw credential response and the original nonce to your server.

- **Interoperability**: By following open standards, digital credentials can work across different operating systems, devices, and platforms.

Audit 0.4.1 · source sha ba2d4bc1b905 · 31 Oct 2026Report an issue or request a re-scan

• Publisherandroid GitHub organizationOwner of the repository this skill is read from
• Source folderandroid/skills/identity/verified-emailThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdictba2d4bc1b905A new audit runs when the source changes
• Repository statusNot archivedLast push 2 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Provides a complete workflow for implementing verified email retrieval

---
name: verified-email
description: Provides a complete workflow for implementing verified email retrieval
  on Android Credential Manager API. Use this skill to integrate a secure, OTP-less
  email verification flow into an Android app. This skill solves the problem of high-friction
  sign-up processes by leveraging cryptographically verified credentials from trusted
  providers like Google.
license: Complete terms in LICENSE.txt
metadata:
  author: Google LLC
  last-updated: '2026-10-28'
  keywords:
  - implementation
  - Android
  - Credential Manager
  - Digital Credentials
  - Verified Email
  - OpenID4VP
  - SD-JWT
  - OTP-less
  - authentication
  - passkeys
  - CredMan
  - identity.
---

## Fundamentals

- *[Overview of Digital Credentials](references/android/identity/digital-credentials/email-verification.md)*: Learn about cryptographically verifiable documents and the role of Credential Manager.
- *[Glossary](references/android/identity/digital-credentials/email-verification-implementation.md)* : Definitions for `dcql_query`, `UserInfoCredential`, and `GetDigitalCredentialOption`.

### Standards \& Examples

- *[OpenID4VP Standard](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-introduction)*: The specification used to create digital credentials requests.
- *[Digital Credentials Demo](https://digital-credentials.dev/)*: Example requests and cross-platform testing tool.
- *[W3C Verifiable Credentials](https://www.w3.org/TR/vc-data-model-2.0/)*: The data model for cryptographically secured claims.
- *[SD-JWT](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/)*: Selective Disclosure JSON Web Token format used for responses.
- *[mdoc](https://www.iso.org/standard/69084.html)*: ISO/IEC 18013-5 standard for mobile documents.

### Requirements

- **SDK Version**: Minimum SDK 28 (Android 9) is required.
- **GMS Version**: Google Play services version 25.49.x or higher.

### Use Cases

Email verification is applicable for the following use cases:

- **Account Creation/Sign-up**: Remove friction by skipping manual email verification.
- **Account Recovery**: Securely verify email ownership during recovery flows.
- **Re-authentication**: Versatile verification for high-risk actions, independent of the initial sign-in method.

### Limitations \& Nuances

- **Workspace Accounts**: Google does not issue verifiable credentials for Google Workspace Accounts.
- **Freshness**: For [email protected] addresses, Google verifies the email at account creation but there is no freshness claim; implement an additional challenge like an OTP.

### Scope \& Pre-requisites

**Crucial** : This skill focuses exclusively on the **Android client-side
integration** . It does **not** implement the app's server-side cryptographic
validation logic. Server-side validation of the returned credential is required
for security and must be implemented in your backend.

## Codebase exploration for Use Cases

Get started with the following queries in project source code to find relevant
screens with different use cases to implement verified email:

- `SignUpScreen`
- `"Email address"`
- `"Recover Account"`
- `"Account Recovery"`
- `"Forgot password?"`
- `"Delete Account"`

## Identifying Integration Points

To implement this feature effectively, you must first locate the relevant
flows in your codebase. To initiate, start with the following strategies to
cater to different use cases using verified email:

### 1. Search for Navigation Routes

If your app uses Navigation, search for routes or destinations related
to authentication:

Look for:

- **Keywords** : `signup`, `registration`, `create_account`, `forgot_password`, `recovery`, `verify_email`.
- **Code Pattern** : Search for `NavHost` or `composable` destinations using these strings.

### 2. Locate Authentication ViewModels

Find the business logic handling user attributes and account creation, account
recovery:

- **Keywords** : `SignUpViewModel`, `AuthViewModel`, `RegistrationRepository`.
- **Code Pattern** : Look for methods like `onCreateAccount`, `onRecoverAccount`, or `validateEmail`.

### 3. Find instances of reauthentication for sensitive actions

For reauthentication use cases, find areas where users perform sensitive
actions:

- **Keywords** : `ChangePassword`, `UpdatePayment`, `DeleteAccount`, `UpdateDetails`, `EditUserDetails`

## Important pointers for Implementation

- Construct a Digital Credential Request and present it to the user.
- Make sure to follow the request JSON structure as mentioned in [documentation](references/android/identity/digital-credentials/email-verification-implementation.md).
- While presenting the request to the user, check if result credential is DigitalCredential and credential.credentialJson as responseJsonString
- Parse the response from the client.
- Offer a passkey creation option if one is not already present.
- Assume a local `SdJwtParser` to parse raw SD-JWT and return a `JSONObject`.
- Use a `VerifiedUserInfo` data class to store the parsed name and email.
- Leave a TODO for developers to handle the app's server-side validation and parsing.
- Direct users to the home screen after API call success and show a snackbar with user details for reference purpose only.

## Overview

This guide describes how to implement verified email retrieval using the
[Digital Credentials Verifier API](https://developer.android.com/identity/digital-credentials/credential-verifier) through an [OpenID for Verifiable
Presentations (OpenID4VP)](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html) request.

## Add dependencies

In your app's `build.gradle` file, add the following dependencies for Credential
Manager:

### Kotlin

```kotlin
dependencies {
    implementation("androidx.credentials:credentials:1.7.0-alpha03")
    implementation("androidx.credentials:credentials-play-services-auth:1.7.0-alpha03")
}
```

### Groovy

```groovy
dependencies {
    implementation "androidx.cre

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/android/skills
git -C skills checkout ba2d4bc1b905

Works in

1. 2026-10-31
   ✕BLOCK D 69 / 100

   first audit · source ba2d4bc1b905

Questions about verified-email

• github.com/android/skills/tree/main/identity/verified-email — the audited source at commit ba2d4bc1b905 and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology