Validator

Check a preference endpoint, or paste a bundle.

We fetch WebFinger over HTTPS, check the discovery document against OPI-PD §5.3, follow the preferences link, load the JWK Set, verify the JWT (ES256, typ: opi-eps+jwt) and check its claims against OPI-EPS §4–§5. Choose PD 0.1 for discovery-first checks; optionally verify the signed bundle.

Subject: handle or domain

Enter user@host (an acct: subject) or https://example.com (an organization). We request /.well-known/webfinger on the host, then follow https://openpreference.org/rel/preferences.

Clear

Equivalent curl

# Example (replace user and host)
curl -sS -H 'Accept: application/jrd+json, */*' \
  "https://openpreference.org/.well-known/webfinger?resource=acct:user%40example.com" | jq .

curl -sS -H 'Accept: application/opi-eps+jwt, */*' \
  "https://openpreference.org/opi/preferences/user"

Waiting for input

Run checks on the left to see a WebFinger trace, verification steps, and the decoded bundle.

What we check

✓ HTTPS GET /.well-known/webfinger
✓ Check rel/preferences, rel/keys, rel/auth and tiers
✓ Fetch the signed bundle (application/opi-eps+jwt)
✓ Check JOSE header: alg, kid, typ
✓ Load JWKS (WebFinger or iss)
✓ Verify ES256 by kid
✓ Check schema, iss, sub, iat, exp, preferences[]