Use VeriProof tools and SDKs

Quick overview

Download approved tools through your signed-in portal session. Choose the CLI for terminal work or an SDK for application code; no GitLab account is required.

VeriProof SDKs use customer-gated GitLab packages, not public registries. Follow the installation instructions shown here for your selected packages.

Choose VeriProof CLI for terminal and automation work or Application SDKs for an application integration.
For the CLI, download the package, run the install command, then sign in and run the health check.
For an application SDK, download a language bundle, select the framework adapters you use, and run the generated commands.
For CI, create a separate package credential for the workload and store its secret in the CI platform.

Workstation installs do not need a package credential. Create a separate named workload credential for each CI pipeline.

The separate application SDK key authorizes one application to send sessions and check policy. Never put the application SDK key in package-manager settings.

Use Tools and SDKs to install the VeriProof CLI or an application SDK. Workstation downloads use your portal sign-in. Automated builds use a separate CI package credential.

VeriProof SDKs are distributed through customer-gated GitLab packages, not public registries. Use the installation instructions shown in the customer portal for your selected language and packages.

Who can use this

Available to

DeveloperAdministrator

Not available to

Governance EngineerCompliance OfficerBusiness OwnerAuditor

Developers install the CLI or SDK packages. Customer Administrators install the CLI and review organization package access.

Choose the right tool

Tool	Use it for	Authorization
VeriProof CLI	Manage supported resources, verify connections, inspect evidence, and run approved automation from a terminal	Your VeriProof sign-in and assigned role
Application SDKs	Record application activity, send sessions, and check policy from application code	The application ID and SDK key

The CLI requires Python 3.10 or later to install. Find it under Command-line tools.

Before you start

To install packages, you need:

an active, non-sandbox VeriProof customer account;
an active portal user with the Developer or Customer Administrator role;
access to the application you are integrating; and
the standard package tool for your language.

Your portal identity controls package downloads and whether you may create a CI package credential. You do not need a separate GitLab account.

Install a VeriProof tool

Open Tools and SDKs

Open Tools and SDKs. Developers choose the CLI or an application SDK. Customer Administrators see the CLI selected for them.

Choose a tool

Choose VeriProof CLI for command-line work. Choose Application SDKs for application integration, then select Python, TypeScript / Node.js, .NET, Java, Go, or Rust. The core SDK is included. Add an Enforce adapter for a supported framework boundary, an integration for setup or telemetry, or a configuration helper for framework registration. Review SDK categories and framework coverage before adding an optional package.

Download the approved package

For the CLI, select its download action. The portal checks your organization and role, then downloads the approved package. No package credential is shown or saved on your computer.

For an application SDK, select the download action for your language and the approved version shown. The bundle includes the core package and approved framework adapters. The generated command installs only your selections.

For an automated build, follow Install packages in CI below.

Install the selected tool

For the CLI, Tools and SDKs shows one pipx install command for the downloaded wheel.

For development computers, Tools and SDKs generates native commands that install the selected packages from the downloaded bundle. The commands do not require a package credential.

For CI, Tools and SDKs generates native setup and install commands for VeriProof’s reviewed GitLab package project. The SDK commands read:


VERIPROOF_PACKAGE_USERNAME=<username shown in Tools and SDKs>
VERIPROOF_PACKAGE_TOKEN=<one-time secret>

TypeScript

Use the shown npm install command for the selected local packages. In CI, keep the token in the environment; do not save it in a checked-in .npmrc.

.NET

Use the shown local NuGet source and dotnet add package commands. In CI, keep the credential outside checked-in NuGet.config files.

Go

Use the bundle’s local Go module proxy and the shown GOPROXY, GONOSUMDB, and go get commands. CI uses the hosted VeriProof proxy with https://proxy.golang.org as its public fallback.

Rust

Use the bundle’s local Cargo registry and the shown cargo add commands. CI uses the hosted Cargo registry and stores its credential in the CI secret store.

Finish the selected path

If you chose the CLI, run the three commands under Sign in and verify. They add the current portal deployment, open your organization’s sign-in page, and run the read-only health check. Continue with the CLI commands and workflows.

If you chose an application SDK, continue with the application steps below.

Configure your application

Return to the application workspace in VeriProof. Copy the application ID and the separate VeriProof application SDK key. Store the key as VERIPROOF_API_KEY in an approved secret manager.

Hosted VeriProof uses https://ingest.veriproof.app by default. For VeriProof Private on Azure, set VERIPROOF_ENDPOINT to the customer’s ingest API base URL. One base URL handles session ingest and policy checks.

Run the governed-action quickstart

After connectivity succeeds, follow Govern your first action. It tests one allowed action and one denied action, then links each decision to its portal evidence.

Package credentials and application authentication are separate. Never place VERIPROOF_API_KEY in package-manager settings, and never give VERIPROOF_PACKAGE_TOKEN to the running VeriProof SDK.

Rotate or revoke access

Tools and SDKs shows the credential owner, type, username, expiry, state, and last access check without showing the secret.

Select Rotate before expiry. When you display the replacement secret, a short overlap begins. Update your environment and test an install before VeriProof revokes the old credential automatically.
Select Revoke to start revocation. Future package downloads stop when the credential reaches Revoked.

For a retired CI workload, select Deactivate workload. VeriProof revokes every active package credential assigned to that workload.

Customer Administrators can revoke a Developer or CI workload credential or remove the Developer role. They cannot create, rotate, or reveal another person’s credential. Removing or deactivating a Developer starts revocation for that person’s package credentials. Suspending the customer account starts revocation for active package credentials across the organization. Tools and SDKs shows progress until each request finishes or needs attention. VeriProof staff never see package secrets.

Revocation does not remove SDK files already downloaded to a workstation, cache, or build artifact. Follow your organization’s offboarding policy for those copies.

Revoking a package credential does not stop an installed SDK from running. To stop an integration from sending sessions or checking policy, revoke its application SDK key or deactivate the application in VeriProof.

Install packages in CI

Create a separate CI credential for each workload. Name the workload, assign a current human owner, choose an expiry of no more than 180 days, and save the one-time secret in the CI platform’s protected secret store. Do not reuse a Developer credential or one CI credential across workloads.

Use the copy-ready CI settings from Tools and SDKs. Rotate the credential before the displayed expiry date and verify a clean CI install during the limited overlap. VeriProof then revokes the old credential automatically. When the pipeline is retired, select Deactivate workload to revoke every credential assigned to it.

Understand status messages

Portal message	Meaning and next step
Package access is ready	Download the selected packages. Create a package credential only for CI.
Credential ready to save	Save the one-time secret before leaving the page.
Credential active	Install packages or rotate before the displayed expiry date.
Rotating credential	Save and test the replacement during the short overlap that begins when its secret is displayed.
Package access is paused	The customer account is suspended. New package requests are denied.
Package access is not available	Package downloads are unavailable in the shared sandbox. Open an active customer workspace.
Package access needs attention	Retry once when offered. If it persists, record the status and redacted error for your Administrator to review.

Troubleshoot installation

The package tool returns 401 or 403

These checks apply to authenticated CI installs. Workstation bundles use local package files and do not require a package credential.

Confirm both package environment variables are set in the current terminal.
Confirm the credential belongs to the intended CI workload and has not expired or been revoked.
Copy the current source and install command from the same VeriProof environment.
Ask a Customer Administrator to review your Developer role and credential state.

The package cannot be found

Confirm the package name, pinned version, and source against Tools and SDKs. Retry in a clean project. Do not replace the private source with a similarly named public package.

The secret was lost

Rotate the credential. A one-time secret cannot be recovered or shown again.

Installation works, but no session appears

Package installation does not configure application authentication. Continue to the application setup page, set the application ID and VERIPROOF_API_KEY, then follow Troubleshoot the SDK.

Prepare diagnostic details

Include the organization name, package language and name, portal status, approximate time, and error text with credentials removed. Never send a package secret, one-time reveal value, application SDK key, or credential-bearing configuration file.