Issuer Agent

Sign in to the admin console

Issuer Agent
—
Overview
Issuing
Issue a credential Bulk issuance Issuance log
Configuration
Credential types DIDs and keys
Connections
Data sources Trust registries
Platform
Developers Applications Email
Signing credentials as
—
—

Overview

Issuance activity for the last 14 days

—
Credentials claimed
 
—
Offers that get claimed
 
—
Offers waiting to be scanned
 
—
Revoked
 

Credentials claimed per day

Today is still counting

Recent activity

    CredentialFormatClaimsValid forRevocableStatus

    Basics

    What wallets will show and how the credential is signed

    Shown on the card inside the holder's wallet.

    dc+sd-jwt

    Once you issue against this address it must never change — credentials already in wallets check against it. This build does not store it, so what you type here is not saved with the credential type.

    The profile sets the credential shape, the DID method and how status is published. Confirm these with the ecosystem operator before issuing.

    Lets verifiers check whether this credential is still valid. Without it a credential cannot be withdrawn once issued.

    Turn this on for anything that has to be conferred rather than looked up — a certificate is awarded, an employment record is a fact the system already knows.

    Claims

    Tick “Selective” to let the holder share a claim on its own

    NameTypeRequiredSelective
    UN
    Employee ID
    Issuer
    dc+sd-jwtExpires 14 Sep 2027

    This is how the card appears in a holder's wallet. Colours come from the display metadata you publish.

    IdentifierKey typeCustodyCredentials signedStatus

    DID document

    Published at /.well-known/did.json — this is what wallets resolve to check your signature

    1Choose a credential
    2Fill in the claims
    3Share the QR code

    Issue a credential

    The holder scans the code you create here and the credential lands in their wallet

    The reference this organisation knows them by.

    The offer can only be used once and expires after 15 minutes.

    Offer ready

    Ask the holder to scan this with any wallet that supports OpenID4VCI

    Scan with a wallet app

     
    Credential
     
    Holder
     
    Grant type
    pre-authorized_code
    Signed by
     
    Status
    Waiting to be scanned
    Expires in
     

    This page updates on its own when the wallet claims the credential.

    HolderCredentialCreatedSourceStatus

    1Choose where the data comes from
    2Check the data
    3Issue and deliver

    Source

    Issue the same credential to many people at once

    Pull from a connected database
    Reads live from your system of record, so the claims are never stale.
    —
    Upload a spreadsheet
    CSV with one person per row. Up to 20,000 rows per run.

    Views are read-only queries defined on the data source connection.

    Up to 20,000 rows per run.

    How the data maps to claims

    Each claim in the schema needs a source

    ClaimSource fieldExample value

    Validation

    Checked against the pinned schema version

    RowPersonProblem

    Delivery

    How each person gets their claim link

    Longer than a single offer, because people claim bulk credentials on their own schedule.

    Issuing

    You can leave this page — the run continues in the background

    Results

    RowPersonResult
    ConnectionTypeUsed byLast checkedStatus

    Connection

    Connection settings

    Not returned by this API — type a new value to replace it. It is stored in the issuer's database, not a vault: anyone who can read that database can read it.

    This account should be read-only The issuer only ever reads from your database. Grant SELECT on the views it needs and nothing more.

    Readable views

    The only tables this connection is allowed to see

    ViewRowsColumns available as claims

    Registries this issuer is listed in

    Verifiers check these to decide whether to accept what you issue

    RegistryProtocolYour statusValid untilLast checked

    What the registry says you may issue

    Read from the registry — you cannot change it here

    Credential typeAuthorizedGranted bySince

    Checking and alerts

    Off by default. Most issuers would rather keep issuing and fix the listing than halt a batch mid-run.

    Issuer metadata

    Wallets read this to find out what you can issue

    —

    Will a wallet accept what you issue

    Runs the whole exchange against this deployment and checks what a wallet checks

    Nothing is sent anywhere. The check claims a credential from this issuer with a throwaway key, verifies the signature, the key binding and the published status list, then deletes what it created.

    API keys

    NameKeyCan doLast used

    Notifications

    We post to your endpoint when something happens to a credential

    EndpointSendsLast delivery

    Registered applications

    An application cannot sign anyone in until it is registered here

    ApplicationClient idCan reachCredential typesLast usedStatus

    Registration settings

    Read from the registry

    A registration permits a browser origin to call this API. It is not how anything signs in: your own portal authenticates people against your IdP and calls the API with an integration key from Developers. Wallets register nothing — they claim over OpenID4VCI.

    Exact address only. Wildcards are not allowed.

    Must be https and match exactly.

    There is no secret for this application, because a secret kept in a browser is not a secret.

    This application can only see each person’s own records It signs people in through your identity provider and can never read anybody else’s credentials, whatever it asks for.

    Mail server

    Claim links and alerts are sent through this relay

    Not returned by this API — type a new value to replace it. It is stored in the issuer's database, not a vault: anyone who can read that database can read it.

    Prefilled with the address you are signed in with.

    Recent deliveries

    What has been sent, and what did not arrive

    ToWhat it wasWhenResult

    Will your mail arrive

    Records your domain needs so claim links do not land in spam

    RecordStatusWhat it does

    Database

    Set where the server is deployed, not here

    Connected
    —
    Schema version
     
    —
    Engine
     
    —
    Schema changes
     
    —
    Last migration
     
    The runtime account can change the database structure It only needs to do that while upgrading. Consider a separate account for migrations.

    Add a signing identity

    Credentials you issue are signed with this key. Holders' wallets use it to check the signature.

    Generate a new key here
    Generated by this deployment. Where the private key then lives depends on the signing backend — on software it is a row in this database. Platform status says which is in use.
    Import a key I already have
    Not available in this build. Importing a private key means accepting key material over HTTP and proving it matches a DID nobody here controls — that is a signing-service job, not a form. Generate here, or configure a KMS backend.

    The host the DID names. Leave it empty to use this deployment's own public address. The DID document is published at /.well-known/did.json.