---
title: "Use the engine in Node.js: verify evidence in the backend"
url: https://knowyouragent.ch/en/knowledge/guides/use-the-engine-in-node
lang: en
updated: 2026-10-17
license: © Innopulse Consulting GmbH
---

# Use the engine in Node.js: verify evidence in the backend

The engine that runs on the verification page in the browser is available as a package under Apache 2.0. In five steps, you verify agent evidence in your own backend, without network access and with the same result as in the browser.

[Leutrim Miftaraj](https://knowyouragent.ch/en/about/leutrim-miftaraj), Founder, Innopulse Consulting GmbH
Published 17 October 2026

## Key points

- The engine runs in Node.js 20 or later without runtime dependencies or network access.
- verify() returns verdict, level, ten checks and a recomputable reportDigest.
- INDETERMINATE means missing evidence and is not success.

## Install the package

The engine has no runtime dependencies and requires Node.js 20 or later. Install the package directly from knowyouragent.ch:

```
npm install https://knowyouragent.ch/downloads/knowyouragent-verify-core-1.2.0.tgz
```

The package checksum is available as a file with the .sha256 extension next to the package; compare it before using the package in production.

## Provide trust

Decide which issuers you trust: their public keys as JWKS, the current status lists for revocation and, for the highest level, the anchors of [timestamp](https://knowyouragent.ch/en/knowledge/glossary/rfc-3161-timestamp) authorities as PEM. The engine loads nothing from the network itself; whatever you do not provide counts as not proven.

## Call verify()

The verify() function takes the evidence as text or bytes and the options now, trustedKeys, statusLists and tsaAnchors:

```
import { readFile } from "node:fs/promises";
import { verify } from "@knowyouragent/verify-core";

const report = await verify(await readFile("evidence.json", "utf8"), {
  trustedKeys: await readFile("issuer-jwks.json", "utf8"),
  statusLists: [await readFile("status-list.jwt", "utf8")],
});

console.log(report.verdict, report.assuranceLabel, report.reportDigest);
for (const check of report.checks) console.log(check.id, check.status, check.reason ?? "");
if (report.verdict !== "VALID") process.exitCode = 1;
```

## Evaluate the result

The verdict is VALID, INVALID or INDETERMINATE, together with the level, all ten checks with status and reason code and a reportDigest that lets the result be recomputed later. The meaning of every code is listed in the [error reference](https://knowyouragent.ch/en/method/errors). Do not treat INDETERMINATE as success: it means that evidence is missing, such as a [status list](https://knowyouragent.ch/en/knowledge/glossary/status-list).

## Build it into the flow

Call verify() where you decide on an action, for example before accepting an order, and store the report or at least the reportDigest together with the transaction. Verification runs locally and deterministically; the same inputs yield the same digest. The engine's behavior is defined by the public [test vectors](https://knowyouragent.ch/en/standard/test-vectors).

## Troubleshooting

The most common results in a first integration and what they mean:

- **issuer_key_not_trusted:** the issuer's key is missing in trustedKeys. Provide the issuer's JWKS.
- **status_list_not_provided:** the mandate refers to a status list that was not passed.
- **unsupported_alg:** the algorithm is not supported; supported are ES256, ES384, EdDSA, RS256 and PS256.

The [error reference](https://knowyouragent.ch/en/method/errors) explains all codes.

## Frequently asked questions

### Does the engine work with TypeScript?

Yes. The package includes type definitions, among them VerifyOptions, Report and Check.

### Can I use the engine in a serverless function?

Yes. It has no runtime dependencies, uses WebCrypto and needs no network access.

### How do I set the verification time?

With the now option, as a date, timestamp or ISO string. This lets earlier verifications be repeated exactly.

### How large is the package?

The package is small and has no runtime dependencies. Besides the code, it contains the JSON schemas, the test vectors and the command line.

### Can I use the engine in the browser of my own application?

Yes. The engine is the same program that runs on the verification page; it can be bundled into web applications.

### How do I process binary evidence such as timestamps?

Pass it as a Uint8Array instead of text. verify() accepts both and detects the format itself.

### What exactly is reportDigest?

A hash over the canonical report. Whoever verifies the same inputs with the same verification time obtains the same value and can thus prove that a result is unchanged.

## Sources

- @knowyouragent/verify-core (Paket): [https://knowyouragent.ch/downloads/knowyouragent-verify-core-1.2.0.tgz](https://knowyouragent.ch/downloads/knowyouragent-verify-core-1.2.0.tgz)
- KYA-Prüfprofil: [https://knowyouragent.ch/standard/pruefprofil](https://knowyouragent.ch/standard/pruefprofil)

---
Quelle: https://knowyouragent.ch/en/knowledge/guides/use-the-engine-in-node · KYA – Know Your Agent