How it works
The credential journey.
Five stages, three parties. This page explains the whole thing without assuming you know anything about digital identity.
Who does what
Digital credentials copy something that already works on paper. A body that knows something issues a document, a person carries it, and someone else looks at it.
Issuer
Confirms the fact from its own records and issues the credential. Can set an expiry and can withdraw it later. Stays responsible for whether the fact is right.
Holder
Keeps the credential on their own device and decides each time whether to share it. Can see who asked and what they asked for.
Checker
Asks for specific facts, receives a checked result, and decides what to do with it. Chooses which issuers it is prepared to accept.
The five stages
Issue
The issuer confirms the fact from its own records, then creates a credential and offers it to the person as a link or a QR code. The credential is signed, so any later change to it shows up.
Hold
The person accepts the offer in a wallet on their own device. The credential is stored there, along with a private key that is generated on the device and never leaves it. That key is what later proves the credential is theirs.
Present
An organisation asks for proof. The person's wallet shows who is asking and what they want. The person approves, and only the facts that were asked for are sent.
Check
The receiving organisation confirms the signature is genuine, that the person holds the credential, that it is in date, that the issuer has not withdrawn it, and that it answers the question asked.
Govern
The issuer can withdraw a credential at any time. Issuers and checkers each keep a record of what happened on their side, so activity can be reviewed later.
Keeping credentials current
This is where digital credentials earn their place: a paper certificate cannot tell you it stopped being true.
- It expires
- The issuer sets an expiry when the credential is created. Once that date passes, a check fails. Nobody has to remember to do anything.
- The issuer withdraws it
- If the situation changes — someone leaves, a registration lapses, a credential was issued in error — the issuer withdraws it. The next check fails. The change takes effect immediately, not at the next renewal.
- The checker finds out
- Each check reads the issuer's current published status. A checker does not need a copy of the issuer's records and does not need to contact them.
- What withdrawal changes
- Every check from that moment returns a failure. The copy on the person's device stays where it is, and checks already completed stand as recorded.
Two things worth understanding
A check proves the credential; the issuer stands behind the claim
A check confirms a named issuer issued this, it is unaltered, it belongs to the person showing it and it is current. Whether the underlying fact is right remains the issuer's responsibility — so the list of issuers you accept is the decision that carries the weight, and it is yours to set.
All three parties share one profile
An exchange works where the issuer, the wallet and the checking service agree on a credential format, a protocol and a way of publishing status. Using open protocols is what makes that agreement possible between organisations that have never dealt with each other. See the standards.
Where does your organisation sit?
Most organisations start on one side of this — either issuing something, or checking something. Pick the one that matches you.