Skip to main content

Verifiable Credentials Overview

A Verifiable Credential (VC) is a digital, cryptographically signed statement made by an issuer about a subject — a digital equivalent of a passport, driving licence, employee badge, or KYC attestation. The format and semantics are standardised by the W3C Verifiable Credentials Data Model.

What makes a credential verifiable is that anyone who receives it can cryptographically check three things without contacting the issuer in real time:

  1. Integrity — the contents haven't been tampered with (signature check)
  2. Provenance — it was really signed by the claimed issuer (key/identity check)
  3. Validity — it hasn't expired or been revoked (status check)

The trust triangle​

Every VC ecosystem involves three roles:

  • The issuer makes claims about a subject ("Alice's date of birth is 1990-01-15") and signs them. With iDen2, this is your system calling Credential Factory.
  • The holder stores the credential in a wallet app and decides when — and which parts — to share. The holder is usually, but not necessarily, the subject.
  • The verifier requests a presentation, checks the cryptography, and consumes the claims. With iDen2, this is your system calling Verification Gateway.

Crucially, the issuer and verifier never need to talk to each other during a verification. Trust is established out-of-band through a Trust Network.

Credential lifecycle​

A credential moves through a predictable lifecycle:

  1. Offer — the issuer creates an offer (POST /api/v1/iaas/credential-offers) and presents it to the holder, typically as a QR code.
  2. Issuance — the holder's wallet claims the offer via OID4VCI and stores the signed credential.
  3. Presentation — when a verifier asks, the holder presents the credential (or selected fields of it) via OpenID4VP.
  4. Verification — the verifier checks signature, issuer trust, expiry, and revocation status.
  5. Revocation (optional) — the issuer can revoke a credential after issuance; verifiers detect this via a status mechanism (e.g. BitstringStatusList).

Privacy by design: selective disclosure​

iDen2 issues credentials in SD-JWT format, which supports selective disclosure: the holder can reveal individual fields (just dateOfBirth, say) without exposing the rest of the credential. The signature remains verifiable over exactly what was disclosed.

Where to go next​