Trust

Verification is the whole point

A credential that can't be checked by the person relying on it isn't much of a credential. Cohiva Credentials is built so verification never depends on us being reachable, trusted on faith, or even involved — the credential proves itself.

Resolvable ids, not opaque codes

Every Issuer Profile, CredentialDefinition and Assertion has an id that is a real, resolvable HTTPS URL — never a urn:. Fetch the id and you get the record back, as Open Badges 2.0 JSON-LD, live. That's the decisive difference from providers that mint non-resolvable identifiers: there, "verification" means trusting a private lookup; here, the id is the record.

Live status, always

The verify page, the verify API and the JSON-LD itself all reflect a credential's current status — valid, expired or revoked — in real time. Revocation and expiry are never deletions: the row is kept, the reason is recorded, and every state change is written to an append-only audit log that UPDATE and DELETE are blocked from touching at the database level.

Data isolation

Each issuer account gets its own database — database-per-tenant, not shared tables with a tenant column. Inside that database, row-level security (FORCE RLS) on every issuer-scoped table is defence in depth on top of the isolation the separate database already provides.

What we don't store

  • Recipient email addresses — hashed with a per-issuer salt on arrival; the plaintext is discarded, never logged.
  • API keys in plaintext — hashed at rest (SHA-256); shown once, at creation.
  • Uploaded badge artwork and branding bytes in the database — stored in typed object storage, not inline rows.

Independently verifiable, on your terms

A custom verify domain lets an issuer serve verification pages, QR codes and JSON-LD from their own hostname (ownership proved by a DNS TXT challenge) while minted ids stay anchored on our origin for portability. A drop-in embed script renders a live-verified badge on any third-party page from the public verify API — no API key, no PII in the request.

Live API surface

The current controls catalog and technical attack surface are published, not just described here: