SDK Reference

wipeCredential()

A defensive primitive that manually overwrites every field of a SignedCredential with zero. Use it in error paths and cleanup hooks to make absolutely sure no credential lingers in memory.

Signature

wipeCredential(credential: SignedCredential): void

When to use it

You called verifyIdentity() but never got to generateProof() (user cancelled, network died, exception thrown).
The user navigated away mid-flow and you have a credential held in a ref or piece of state.
You are running tests and want to confirm the credential is neutralised between cases.

Already wiped after generateProof()

You do not need to call wipeCredential() after a successful generateProof(). That function already zeroes the credential in place. This is purely a defence-in-depth helper.

Behaviour

Sets every string field to '0'.
Sets every number field to 0.
Replaces the arrays inside signature.R8 with ['0', '0'] in place.
Synchronous. Returns nothing.

Example — defensive error handling

defensive-wipe.ts

import {
  verifyIdentity,
  generateProof,
  wipeCredential,
} from '@africazk/identity'

let credential
try {
  credential = await verifyIdentity({ idType: 'NIN', idNumber, dob })
  const proof = await generateProof(credential)
  // generateProof() already wiped it — but we belt-and-braces it below
  return proof
} catch (error) {
  // Make sure the credential is cleaned up even on the error path
  if (credential) wipeCredential(credential)
  throw error
}

Limitations

JavaScript does not give us hard guarantees about memory residency — engines can keep copies in interpreter caches, garbage collection runs on its own schedule, and strings are immutable. Althea designs its data flow so that personal data is never derivable from the credential alone (the NIN is already Poseidon-hashed by the backend), but wipeCredential() is a best effort, not a cryptographic guarantee.