Developers

Build on the Credentials API

Every surface in the console is also a public or API-key-authenticated REST endpoint. There is no functionality that exists only behind the admin UI — the SDK and the console call the same API.

install.sh
public npm
# Typed client over the public REST API — no hand-rolled HTTP
npm install @cohiva/credentials-sdk

Authentication

Every partner-facing call authenticates with the issuer's API key: Authorization: Bearer <key> or X-API-Key: <key>. Keys are hashed at rest (SHA-256) and shown in full exactly once, at creation, in the console. There is no way to retrieve a lost key — only reissue one.

Core endpoints

  • POST /api/v1/credentials — issue a credential, idempotent on completionKey
  • GET /api/v1/credentials — list issued credentials, paginated and filterable by status/definition
  • POST /api/v1/definitions · GET /api/v1/definitions[/:id] — manage credential definitions (Open Badges BadgeClass)
  • POST /api/v1/ingest/csv — CSV/manual import: batch issue with a per-row report
  • POST /api/v1/ingest/completions — generic REST ingest of one completion (connector seam)
  • GET /api/v1/reports/issuance · /issuance.csv — issuance/lifecycle/verifies by definition, with CSV export
  • POST /api/v1/pathways · /:id/stages · /:id/progress — staged pathways and recipient progress
  • POST /api/v1/credentials/:id/revoke · /reissue — lifecycle changes, never a silent delete

Public verification (no auth)

  • GET /v1/issuers/:slug — Issuer Profile, Open Badges 2.0 JSON-LD
  • GET /v1/issuers/:slug/badges/:defSlug — CredentialDefinition (BadgeClass) JSON-LD
  • GET /v1/issuers/:slug/assertions/:id — Assertion JSON-LD — the id resolves to itself
  • GET /verify/:slug/:id — human verification page with QR
  • POST /api/v1/verify · /verify/bulk — verify one or many credentials by assertion id

Connectors

If completions already flow through a system you use, a connector can pick them up without a custom integration: JobReady, aXcelerate, eSkilled, Canvas, Moodle and generic HRIS presets run on the same connector engine, mapping provider fields to an issuance. Zapier and Make are also supported, for teams who'd rather wire it up with no code at all.

Webhooks

Register an endpoint in the console and subscribe to credential.issued, revoked, reissued, expired or verified. Every delivery is signed (X-Cohiva-Signature: sha256=…, HMAC over the body) and retried with backoff on failure.

Embed a live-verified badge

Renders from the public, no-auth verify API — no key, no PII in the request.

embed.html
<div data-cohiva-credential="https://api.credentials.cohiva.app/v1/issuers/ampd/assertions/<id>"></div>
<script src="https://api.credentials.cohiva.app/embed/v1.js"></script>
API sandbox & docs OpenAPI 3 spec

Also ships

  • A headless React widget (@cohiva/credentials-embed/react) for custom UI
  • Pure SSR render functions for server-rendered embeds
  • A profile/wall embed (data-cohiva-profile) for an earner's whole public wallet