Paste a credential, or open the link on a certificate. No account, no app, and nothing to install.
Show this code to the worker. Their wallet signs the credential for this check only, so a copy taken from someone else's phone will not pass.
Drop in the credential you were given, or open the link printed on the certificate.
The maths has to add up, and the key has to belong to the issuer named on the record.
Whether it holds, who issued it, and whether valid.ca has approved that issuer.