Labels, carriers and verifiable credentials

The public passport

The public view is served from its own route without the operator console, carries your branding and shows only what you published - redacted paths are removed from the public response, not merely hidden on the page.

The document title names the product and the issuer, which is what a search engine and a shared link will show.

Carriers for the physical product

The carrier panel renders a QR code and a GS1 Digital Link for a passport, and the label sheet prints carriers in a printable grid with the console chrome hidden.

For regulated labelling you can render a DataMatrix as a GS1 element string with the application identifiers, or as a Digital Link URI. Element strings are validated against the application-identifier table before rendering, so an over-long serial is refused with a readable message rather than producing an unreadable symbol. If one item on a label sheet is invalid, that label falls back to the URI symbol and reports a warning instead of failing the whole sheet.

Radio-frequency identification tags can be encoded from the product's GTIN in the standard electronic product code form.

Verifiable credentials

Issuing a credential signs the published passport with an organization key as a verifiable, standards-shaped token. Only a published passport can be credentialed, and the claims are built from the redacted public view, so a credential can never leak something the public passport withholds.

What it proves is integrity: this is the product identity and this version of the passport, and its content has not changed. It never encodes a compliance verdict. Re-issuing a credential supersedes the earlier one while leaving it cryptographically valid, keys can be rotated without invalidating what they signed, and a credential can be revoked.

Independent verification

The public verification page checks a token or a passport without an account and reports each check with its reason: signature, validity window, revocation status, record integrity and payload freshness. The public key set is published so a third party can verify a token with their own tooling rather than trusting your word for it.

Organization identity and did:web

Under Settings, Organization identity, prove who issues your passports: your LEI is checked against the GLEIF register (active entity, current registration), your EU VAT number against the European Commission's VIES service, and your web domain by a DNS TXT record you publish. LEI and VAT are re-checked every 30 days; a lapsed registration is shown as such. If the registry's legal name differs from your organization's name, an owner confirms it explicitly.

Your organization also has a DID (did:web on this site). Its DID document lists the keys your passport credentials are signed with and your verified identifiers, so a verifier can check what you sign without asking us. Verified identifiers appear on your public passports as the verified issuer. Suppliers' identifiers are checked the same way on the supplier page.

Offline access

The consumer surface can be installed and caches visited passports so a scan still opens something useful without a connection, with an offline notice shown when a page came from the cache.

Is the authenticity credential issued automatically?

Yes. Publishing a passport issues its authenticity credential at once, and a background check every minute issues one for any published passport that lacks a current credential - after a bulk publication, for example - and renews credentials 30 days before they expire. The public page shows who signed the credential, for which version and until when, with a link to verify it.

Saving a draft after publication does not affect verification: the credential describes the published release, which stays public until the next version is published and replaces it.

Screen-by-screen reference

These pages were checked in the organization console on 8 October 2026 using an isolated sample organization. Controls can differ by role, plan, record state and configured providers. Each page below explains its purpose, a practical workflow, the visible controls and what to verify afterward.

Serialized items (/dpps/[id]/items)

Item identities let one passport represent many individual serials or batches while keeping item status and carrier links distinct.

Confirm the product GTIN before generating serials or batches because the item Digital Link depends on it. Use filters to inspect an individual item's current status, then export carrier data for the specific encoding equipment. Item lifecycle changes should be recorded through the item workflow so public status remains traceable.

Item states exposed publicly are coarser than internal sales states.

Controls and options

• Add a valid GTIN to the product first; item Digital Links require it.
• Filter by serial or status, then inspect each item's batch, status and Digital Link.
• Use the item forms to register existing serials or generate a bounded background job of new serials.
• Export print/encode data for QR, DataMatrix or NFC equipment; item status changes remain traceable.

Printable labels (/dpps/labels)

This print view lays out carrier cards for selected passports and their item links.

Match the displayed product and encoded URL to the intended published passport or item before printing a batch. Choose the carrier format your label equipment and destination support, then inspect the browser print preview for clipping or scaling. Reprint labels if the underlying link or item assignment changes.

A label is only as current as the published passport or item link it encodes.

Controls and options

• Choose QR, DataMatrix or both when the page offers carrier format controls.
• Check product identity and encoded URL before printing or applying labels.
• Use the browser print command for the sheet layout.

GS1 identifiers (/settings/gs1)

Prefix claims connect organization GTINs to licensed GS1 company prefixes for ownership checks.

Separate three questions when reviewing a GTIN: whether its check digit is valid, whether it belongs to a licensed company prefix, and whether another product already uses it. Submit prefix evidence and wait for its verification status before relying on ownership claims. Correct an invalid product GTIN at the catalogue source, then recheck dependent links or labels.

GTIN exclusivity is enforced even when prefix checking is only a warning.

Controls and options

• Read How your GTINs are checked to distinguish check-digit validity from licensed-prefix review.
• Submit a company-prefix claim with evidence for operator verification.
• Inspect Claimed prefixes for pending or verified status.
• Correct a product GTIN if ownership or exclusivity validation fails.

Verifiable credentials (/settings/credentials)

The signing key and issued credential list show how published passport claims are signed, rotated and revoked.

Inspect the active signing key and public verification reference before issuing a new credential. Rotation changes which key signs future claims; it should be coordinated with systems that verify the organization's DID keys. Revoke a credential whose underlying claim is no longer valid and check how that status appears to a verifier.

A valid platform signature does not certify the underlying product declaration.

Controls and options

• Inspect the active signing key and public verification reference.
• Rotate signing key when key management requires it; previously issued credentials remain verifiable through published keys where supported.
• Review issued credentials and revoke an affected one rather than changing its signed content.

Organization identity (/settings/identity)

This page publishes the organization's DID document and manages verified LEI, EU VAT and web domain identifiers.

Use the DID document to see which public keys and verified identifiers others can inspect. Add an LEI, EU VAT number, or controlled web domain with the matching verification method, then read the status and check time before citing it. A successful identity check applies to that identifier; it does not validate every product declaration.

A verified identifier proves the named identity check, not every claim the organization makes.

Controls and options

• Open the DID document to see public verification keys and confirmed identifiers.
• Choose identifier kind, enter the value, then Add and check against GLEIF, VIES or DNS as appropriate.
• Inspect verification status, evidence and checked time before citing the identifier in a passport.
• Owner-only changes follow the page's access rules.