Build on Thoryn with open, standards-first APIs.

1. 1

   Install the CLI

   Pull the native binary. Linux and macOS supported; Windows preview lands with the next CLI minor.

   step-1.shCopy

   # 1. Install the thoryn CLI (Homebrew on macOS, curl on Linux).
   brew install thoryn-io/tap/thoryn
   
   # Verify the install.
   thoryn --version

2. 2

   Authenticate against the sandbox

   Opens a browser, runs OAuth 2.0 + PKCE against sandbox.thoryn.org, stores a refresh token under your XDG config dir.

   step-2.shCopy

   # 2. Authenticate against the sandbox tenant.
   # Opens a browser to https://sandbox.thoryn.org/oauth2/authorize and
   # stores a refresh token under ~/.config/thoryn/credentials.
   thoryn login --hub https://sandbox.thoryn.org

3. 3

   Register a client

   Each relying party gets its own OAuth client with explicit redirect URIs and scopes.

   step-3.shCopy

   # 3. Register an OAuth client for your local relying party.
   thoryn clients create \
     --name "My quickstart app" \
     --redirect-uri http://127.0.0.1:8888/login/oauth2/code/sandbox \
     --grant-types authorization_code,refresh_token \
     --scopes openid,profile

4. 4

   Issue a test credential

   The sandbox issuer-bridge signs a W3C VC 2.0 with the tenant's Vault Transit key and returns the compact JWS.

   step-4.shCopy

   # 4. Mint a test credential against the sandbox issuer-bridge.
   curl -X POST https://sandbox.thoryn.org/broker/issue \
     -H "Authorization: Bearer $(thoryn token --scope broker:issue)" \
     -H "Content-Type: application/json" \
     -d '{
       "credentialType": "TestSustainabilityCertification",
       "subject": { "id": "did:example:holder", "name": "Acme Co." },
       "validFrom": "2026-01-01T00:00:00Z",
       "validUntil": "2027-01-01T00:00:00Z"
     }'

5. 5

   Verify it end to end

   Pipe the JWS into /broker/verify/walletless. The verdict + audit row id come back in under 200ms.

   step-5.shCopy

   # 5. Verify the credential round-trips end to end.
   # Pipe the compact JWS from step 4 into the verify endpoint.
   curl -X POST https://sandbox.thoryn.org/broker/verify/walletless \
     -H "Content-Type: application/json" \
     -d '{ "credentialJws": "<paste the JWS from step 4>" }'
   
   # Expected response:
   # { "verdict": "VALID", "policyVersion": "walletless-v1", ... }

curl -X POST https://sandbox.thoryn.org/broker/verify/walletless \
  -H "Content-Type: application/json" \
  -d '{
    "credentialJws": "eyJhbGciOiJFUzI1NiIsImtpZCI6Im1wcy0yMDI2In0..."
  }'

# Returns { verdict, policyVersion, credentialClaims, auditRowId }

curl -X POST https://sandbox.thoryn.org/broker/issue \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialType": "FSISustainabilityCertification",
    "subject": { "id": "did:example:holder" },
    "validFrom": "2026-05-12T00:00:00Z",
    "validUntil": "2027-05-12T00:00:00Z"
  }'

# Returns { credentialJws, auditRowId, statusListEntry }

curl -X POST https://sandbox.thoryn.org/broker/revoke \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "credentialId": "urn:thoryn:cred:01HZ0...",
    "reason": "key_compromise"
  }'

# Flips the Status List 2021 bit and propagates to DAG descendants.

curl https://sandbox.thoryn.org/broker/audit-replay \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --get \
  --data-urlencode "auditRowId=01HZ0X..." \
  --data-urlencode "asOf=2026-05-01T00:00:00Z"

# Replays the verification as it would have run on asOf —
# uses historical JWKS + Status List bit at that moment.

Full OpenAPI reference and per-endpoint guides live on docs.thoryn.org.

Status reflects the broker, not every SDK. SDK conformance is tracked per release.