Developer Docs
Glossary
Key terms and concepts in the verifiable credentials ecosystem.
A
- AAMVA (American Association of Motor Vehicle Administrators)
- AAMVA is the organization that develops standards for driver's licenses and identification in North America. AAMVA maintains the ISO 18013-5 mDL implementation guidelines and operates the VICAL (Verified Issuer Certificate Authority List) for trusted IACA certificates.
- ACORD
- The Association for Cooperative Operations Research and Development, the insurance industry's standards body. ACORD forms are the traditional paper-based method for sharing insurance certificates. Verifiable credentials replace ACORD forms with cryptographically signed digital certificates that can be verified instantly.
- ACP (Agentic Commerce Protocol)
- An open standard for programmatic commerce flows between AI agents, buyers, and businesses. Developed by Stripe and OpenAI, ACP enables AI agents to conduct secure transactions including checkout coordination and payment credential sharing without exposing underlying payment information.
- AML (Anti-Money Laundering)
-
A set of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income. In the verifiable credentials context, AML checks verify that entities are not on sanctions lists or involved in money laundering. Regulated providers issue AML compliance credentials that can be verified by downstream parties.
See also
- ARF (Architecture Reference Framework)
- The European Union's technical specification document for the EUDI Wallet ecosystem. It defines the architecture, protocols, and interfaces that wallet providers must implement to be compliant with EU Digital Identity regulations.
- Article 50 (EU AI Act)
- The provision in the EU AI Act requiring transparency obligations for AI systems, including mandatory labeling of AI-generated content and synthetic media. Article 50 drives adoption of content authenticity standards like C2PA for proving whether content was created by humans or AI.
B
- Batch Issuance
-
The process of issuing multiple credentials at once, typically through automated workflows or data source synchronization. This is common when onboarding existing records into a verifiable credential system.
See also
- Bitstring Status List
-
A W3C specification for efficient credential status checking using compressed bitstrings. Each credential is assigned an index in a status list; setting that bit indicates a status change. Supports both revocation (permanent invalidation) and suspension (temporary hold). Enables scalable status management for millions of credentials while maintaining privacy.
See also
C
- C2PA (Coalition for Content Provenance and Authenticity)
-
A cross-industry coalition developing technical standards for certifying the source and history of media content. C2PA specifications enable content creators to cryptographically sign their work, allowing viewers to verify authenticity and detect AI-generated or manipulated media. Used for combating misinformation and proving content provenance.
See also
- California AB 2013
- A California law requiring AI developers to disclose training data sources and provide transparency about how generative AI models are trained. Part of a growing trend of AI transparency legislation that may require verifiable attestations about training data provenance and model lineage.
- CBOR (Concise Binary Object Representation)
- A binary data format designed for small code size and small message size, defined in RFC 8949. CBOR is used by mDoc credentials for compact encoding, making it ideal for storage on mobile devices and transmission via QR codes or NFC.
- Claim
-
A statement about a subject, expressed as a key-value pair within a credential. For example,
"dateOfBirth": "1990-01-15"is a claim asserting the holder's birth date. Claims can be selectively disclosed in SD-JWT, mDoc, and ecdsa-sd-2023 formats. - CLR (Comprehensive Learner Record)
-
A 1EdTech specification that extends Open Badges 3.0 to support multiple achievements in a single credential. CLR 2.0 is designed for transcripts and learning pathways, allowing institutions to issue comprehensive records of a learner's achievements, competencies, and credentials in one verifiable document.
See also
- COI (Certificate of Insurance)
-
A document proving that a business or individual holds valid insurance coverage. Verifiable COIs can be issued as digital credentials, allowing contractors to prove coverage instantly without paper certificates. This eliminates the risk of accepting expired, forged, or canceled insurance documentation.
See also
- COSE (CBOR Object Signing and Encryption)
-
A standard for signing and encrypting data using CBOR encoding, defined in RFC 9052. mDoc credentials use
COSE_Sign1structures to sign the Mobile Security Object (MSO) and support algorithms like ES256 (ECDSA with P-256). - Credential
-
A set of claims made by an issuer about a subject (typically the holder). In the digital context, a verifiable credential is cryptographically signed to prove authenticity and detect tampering.
See also
- Credential Offer
- An OpenID4VCI mechanism where an issuer creates a pre-authorized offer that a holder can accept to receive a credential. The offer is typically shared via QR code or deep link and contains a pre-authorized code for the credential exchange.
- Credential Schema
- A template that defines the structure and types of claims for a credential. Schemas ensure interoperability by establishing consistent data formats across different issuers and verifiers.
- CRL (Certificate Revocation List)
- A list of certificates that have been revoked by a certificate authority before their expiration date, defined in RFC 5280. In the IACA context, CRLs allow verifiers to check if a Document Signer Certificate has been revoked. An alternative is OCSP (Online Certificate Status Protocol) for real-time checks.
D
- Data Integrity
-
A W3C specification for expressing cryptographic proofs in JSON-LD documents. Data Integrity proofs are an alternative to JWT-based signatures for verifiable credentials, using linked data signatures that preserve the JSON-LD structure. Modern cryptosuites include
ecdsa-rdfc-2019,eddsa-rdfc-2022, andecdsa-sd-2023for selective disclosure. - DCQL (Digital Credentials Query Language)
-
A query language defined in OpenID4VP for specifying which credentials a verifier requests. DCQL is simpler than Presentation Exchange, using a
credentialsarray with optionalcredential_setsfor grouping requirements. Each credential query specifies format, claims, and trust anchors without JSONPath expressions. - DID (Decentralized Identifier)
-
A globally unique identifier that does not require a centralized registration authority, defined by the W3C DID specification. DIDs are resolved to DID Documents containing public keys and service endpoints. Common methods include did:web (web-based) and did:key (self-contained).
See also
- DID Document
- A JSON-LD document that describes the DID subject, including public keys for verification, authentication methods, and service endpoints. When you resolve a DID, you get its DID Document.
- DID Resolution
-
The process of retrieving a DID Document from a Decentralized Identifier. Resolution involves parsing the DID method, querying the appropriate resolver (e.g., fetching
/.well-known/did.jsonfor did:web), and returning the DID Document containing public keys and service endpoints. - did:key
-
A DID method where the identifier itself contains a cryptographic public key. A
did:key:z6Mk...can be resolved without any external lookup—the public key is encoded directly in the DID. Ideal for ephemeral identities, testing, and scenarios where external infrastructure isn't needed. - did:web
-
A DID method that uses existing web infrastructure. A
did:web:example.comresolves tohttps://example.com/.well-known/did.json. This is the most practical method for organizations that already have established web domains. - DIF (Decentralized Identity Foundation)
- A non-profit organization developing open standards for decentralized identity. DIF hosts specifications including Presentation Exchange, DIDComm, and MCP-Identity, with members spanning major tech companies, financial institutions, and identity-focused startups.
- Digital Credentials API
- A browser API that enables web applications to request identity credentials stored in mobile wallets. The API provides a standardized way for websites to invoke wallet apps for credential presentation, supporting both same-device and cross-device flows via QR codes.
- Disclosure
- In SD-JWT, a disclosure is a base64url-encoded string containing a salt, claim name, and claim value. When presenting a credential, the holder includes only the disclosures for claims they want to reveal. The verifier can verify these against the hashes in the credential.
- DSC (Document Signer Certificate)
- In the mDoc/ISO 18013-5 context, a certificate issued by an IACA that is used to sign mDoc credentials. The DSC's private key signs the Mobile Security Object (MSO), and verifiers check that the DSC chains to a trusted IACA. Not to be confused with 'Digital Signature Certificate' used in other PKI contexts (e.g., for signing tax documents in India).
E
- 1EdTech
- Formerly IMS Global Learning Consortium, 1EdTech is the standards organization behind Open Badges 3.0 and CLR (Comprehensive Learner Record) 2.0. These specifications align with W3C Verifiable Credentials, enabling interoperable digital credentials for education and workforce development.
- ECDSA (Elliptic Curve Digital Signature Algorithm)
- A cryptographic signature algorithm using elliptic curve cryptography, defined in FIPS 186-5. ECDSA with the P-256 curve (ES256) is the most common algorithm for signing verifiable credentials in both JWT and mDoc formats. It provides strong security with relatively small key and signature sizes.
- ecdsa-sd-2023
- A W3C Data Integrity cryptosuite that enables selective disclosure for JSON-LD Verifiable Credentials. Unlike SD-JWT (which uses a flat JWT structure), ecdsa-sd-2023 preserves the full W3C VC data model, making it compatible with Open Badges 3.0 and CLR 2.0. Uses HMAC commitments to prove hidden claims exist without revealing their values.
- eIDAS 2.0
- The updated EU regulation on electronic identification and trust services. eIDAS 2.0 mandates that EU member states provide citizens with digital identity wallets (EUDI Wallets) by the end of 2026, with relying parties (banks, payment providers) required to accept them from December 2027.
- Embedded Renderer
-
An iframe-based component for displaying verifiable credentials using their associated visual templates. The renderer uses the
postMessageAPI for communication, allowing the host application to send credentials and receive events like field obfuscation requests. This implements the W3C VC Render Method specification.See also - EU AI Act
- The European Union's comprehensive AI regulation establishing rules for AI systems based on risk levels. Requires transparency about AI-generated content, mandatory labeling of synthetic media, and documentation of training data. High-risk AI systems must maintain verifiable records of their development and deployment.
- EU Digital Services Act
- A European regulation establishing rules for digital platforms including content moderation, algorithmic transparency, and user protections. Requires very large platforms to assess and mitigate systemic risks, with potential applications for verifiable credential-based identity verification and age assurance.
- EU PID (European Union Personal Identification Document)
- A standardized digital identity credential issued by EU member states as part of the EUDI Wallet ecosystem. The EU PID contains core identity attributes (name, date of birth, nationality) and serves as the foundational credential for accessing public and private services across the European Union.
- EUDI Wallet (European Digital Identity Wallet)
- The EU's initiative to provide all EU citizens with a digital wallet for storing and presenting identity credentials. The EUDI Wallet uses SD-JWT VC and mDoc formats and implements OpenID4VCI/VP protocols. Member states must offer EUDI Wallets to citizens by the end of 2026.
F
- FERPA (Family Educational Rights and Privacy Act)
- A US federal law protecting the privacy of student education records. When educational credentials are issued as verifiable credentials, they must comply with FERPA requirements, giving students control over who can access their academic records while enabling selective disclosure of specific achievements.
G
- GDPR (General Data Protection Regulation)
- The European Union's data protection law governing how personal data is collected, stored, and processed. Verifiable credentials support GDPR principles by enabling data minimization through selective disclosure—users share only the specific claims needed rather than entire documents.
H
- HAIP (High Assurance Interoperability Profile)
- A profile defined by the OpenID Foundation that specifies a constrained set of options from OpenID4VCI and OpenID4VP for high-assurance use cases. HAIP ensures interoperability by limiting the flexibility of the base specifications, requiring specific algorithms, key types, and credential formats (SD-JWT VC and mDoc).
- HIPAA (Health Insurance Portability and Accountability Act)
- A US federal law that establishes national standards for protecting sensitive patient health information. Healthcare credentials issued as verifiable credentials must comply with HIPAA's Privacy and Security Rules, enabling secure sharing of provider credentials, patient authorizations, and medical certifications while maintaining required privacy protections.
- Holder
- An entity that possesses verifiable credentials. The holder is typically (but not always) the subject of the credentials. Holders store credentials in their wallet and present them to verifiers when requested. Examples include a person with a mobile driver's license on their phone, an employee carrying work credentials, or a student with a digital diploma.
- Holder Binding
-
A cryptographic mechanism that binds a credential to a specific holder, preventing credential sharing. The holder must prove possession of a private key when presenting the credential. Also called "key binding" in SD-JWT terminology.
See also
I
- IETF (Internet Engineering Task Force)
- The standards organization that develops and promotes internet standards, including many used in verifiable credentials. IETF publishes RFCs (Request for Comments) defining JWT, JWK, SD-JWT, and other foundational specifications for credential formats and cryptographic operations.
- ISO 18013-5
- The international standard for mobile driver's licenses (mDL). ISO 18013-5 defines the mDoc credential format, CBOR encoding, device engagement protocols, and the IACA trust framework. It's the foundation for digital driver's licenses in Apple Wallet, Google Wallet, and state DMV programs.
- ISO 23220
- An international standard series for generic identity credentials using the mDoc format. While ISO 18013-5 is specific to driver's licenses, ISO 23220 extends the same technology to other identity documents like national IDs, residence permits, and age verification credentials.
- Issuer
-
An entity that creates and signs verifiable credentials. Issuers are typically authoritative sources for the claims they make, such as universities issuing diplomas or governments issuing identity documents.
See also
J
- JSON-LD (JSON for Linking Data)
- A method of encoding Linked Data using JSON, defined by the W3C JSON-LD specification. W3C Verifiable Credentials use JSON-LD contexts to provide semantic meaning to claims, enabling different systems to understand the same data consistently.
- JWK (JSON Web Key)
-
A JSON data structure that represents a cryptographic key, defined in RFC 7517. JWKs are used in DID Documents to publish public keys for signature verification. Multiple JWKs can be grouped in a JWK Set (JWKS).
See also
- JWT (JSON Web Token)
- A compact, URL-safe means of representing claims to be transferred between two parties, defined in RFC 7519. JWTs consist of three parts: header, payload, and signature. They're widely used in authentication and are the foundation for JWT VC credentials.
- JWT VC
- A verifiable credential encoded as a JSON Web Token. JWT VCs embed credential claims in the JWT payload and are signed using standard JWT signatures (typically ES256). They're compatible with existing OAuth/OIDC infrastructure but don't support selective disclosure without extensions like SD-JWT.
K
- Key Binding
- In SD-JWT, key binding is achieved through a Key Binding JWT (KB-JWT) that the holder signs when creating a presentation.
- Key Management
- The processes and infrastructure for generating, storing, rotating, and protecting cryptographic keys used to sign credentials. Secure key management is critical for issuers—compromised signing keys allow credential forgery. Solutions range from hardware security modules (HSMs) to cloud key management services.
- KYC (Know Your Customer)
- The process of verifying the identity of customers before or during business transactions. KYC verifiable credentials allow identity verification to be performed once by a regulated provider, then reused across multiple services without repeating the verification process. This reduces friction while maintaining compliance.
L
- L402
- A protocol that uses the HTTP 402 Payment Required status code combined with Bitcoin Lightning Network payments to enable machine-to-machine micropayments. L402 allows APIs to be monetized per-request, with payment proofs (macaroons) serving as access credentials.
- LMS (Learning Management System)
-
Software platforms for delivering, tracking, and managing training and educational content. Examples include Cornerstone, Workday Learning, and Moodle. When integrated with verifiable credentials, LMS platforms can automatically issue tamper-proof certificates upon course completion that are portable across employers.
See also
M
- MCP (Model Context Protocol)
- An open protocol developed by Anthropic for connecting AI models to external data sources and tools. MCP enables AI agents to securely access APIs, databases, and services through a standardized interface, making it foundational for agentic workflows that require verifiable credentials or payments.
- MCP-I (Model Context Protocol Identity)
- An open standard for AI agent identity, donated to the Decentralized Identity Foundation (DIF). MCP-I uses W3C Verifiable Credentials to let agents prove who authorized them and what they're allowed to do, enabling secure delegation chains and instant revocation for autonomous AI systems.
- mDL (Mobile Driver's License)
- A digital representation of a driver's license stored on a mobile device. mDLs use the mDoc format and are standardized under ISO 18013-5. Several US states and countries have deployed or are piloting mDL programs.
- mDoc (Mobile Document)
- The credential format defined in ISO 18013-5 for mobile driver's licenses. mDocs use CBOR encoding and are designed for offline verification scenarios. The format supports selective disclosure natively and is adopted by Apple Wallet and Google Wallet.
- MiCA (Markets in Crypto-Assets Regulation)
- The European Union's regulatory framework for cryptocurrency and digital assets. MiCA establishes licensing requirements for crypto service providers and stablecoin issuers, with compliance often requiring verifiable credentials for KYC/AML and proof of authorization.
- MPP (Machine Payments Protocol)
-
An open protocol for machine-to-machine payments that standardizes HTTP 402 responses for payment-gated APIs. MPP supports multiple payment methods including stablecoins, Lightning Network, and traditional cards, enabling AI agents and automated systems to pay for services programmatically.
See also
- MSO (Mobile Security Object)
-
The signed portion of an mDoc credential that contains digests (hashes) of all claims. The MSO is signed by a Document Signer Certificate (DSC) using
COSE_Sign1. During verification, the MSO signature is checked against the IACA trust chain, and disclosed claims are verified against their digests in the MSO. - My Number Card
- Japan's national identification card system (Individual Number Card or マイナンバーカード). The My Number Card includes an IC chip for digital authentication and is being integrated with mobile wallets to enable digital identity verification. Japan is adopting mDoc and verifiable credential standards for mobile ID use cases.
N
- NFT Tickets
-
Event tickets issued as non-fungible tokens or verifiable credentials on a blockchain or through cryptographic signatures. NFT tickets provide proof of authenticity and ownership, prevent counterfeiting, and can include programmable features like transfer restrictions or automatic royalties on resales.
See also
O
- OAuth/OIDC
- OAuth 2.0 is an authorization framework, and OpenID Connect (OIDC) is an identity layer built on top of it. JWT VCs are designed to be compatible with existing OAuth/OIDC infrastructure, and OpenID4VCI/VP extend these protocols specifically for verifiable credential issuance and presentation.
- Obfuscation
-
The process of hiding or redacting specific fields in a verifiable credential before sharing it. In the context of selective disclosure, obfuscation allows holders to hide sensitive claims (like a social security number) while still sharing other claims from the same credential.
See also
- Open Badges
- A 1EdTech specification for digital badges that recognize learning achievements, skills, and competencies. Originally developed by Mozilla, Open Badges 3.0 aligns with W3C Verifiable Credentials, allowing badges to be issued, stored, and verified using VC infrastructure with full interoperability.
- OpenID4VCI (OpenID for Verifiable Credential Issuance)
- An OpenID Foundation specification that defines how wallets can receive verifiable credentials from issuers. It supports pre-authorized code flow (for credential offers) and authorization code flow (for user-initiated issuance).
- OpenID4VP (OpenID for Verifiable Presentations)
- An OpenID Foundation specification that defines how wallets can present verifiable credentials to verifiers. The spec supports two query formats: Presentation Exchange (PE) for complex requirements and DCQL for simpler queries. Supports both same-device and cross-device flows.
- OSHA (Occupational Safety and Health Administration)
- A US federal agency responsible for workplace safety regulations. OSHA certifications (such as OSHA 10 and OSHA 30 training) can be issued as verifiable credentials, allowing workers to prove their safety training to employers and site managers instantly without paper certificates.
P
- PII (Personally Identifiable Information)
- Any data that can be used to identify a specific individual, such as name, date of birth, social security number, or address. Verifiable credentials with selective disclosure allow holders to prove claims without revealing unnecessary PII—for example, proving you're over 21 without sharing your exact birth date.
- postMessage API
-
A browser API for secure cross-origin communication between windows or iframes. In the context of embedded credential renderers, the host application uses
postMessageto send credentials to the renderer iframe and receive events like obfuscation requests. Messages have atypeand optionalpayload.See also - Presentation
- A package of credentials (or derived proofs from credentials) that a holder shares with a verifier. In formats supporting selective disclosure, a presentation may contain only a subset of the original credential's claims.
- Presentation Definition
- A JSON structure from the Presentation Exchange specification that describes what credentials and claims a verifier is requesting. It defines input descriptors with constraints on credential types, formats, and required claims.
- Presentation Exchange (PE)
- A DIF specification that defines a query language for requesting verifiable credentials. Uses Presentation Definitions with input descriptors and JSONPath constraints to specify required credentials and claims. OpenID4VP supports both PE and the simpler DCQL query format.
R
- Render Method
-
A property in a verifiable credential that specifies how the credential should be visually displayed. Defined in the W3C VC Data Model, the
renderMethodcan reference SVG templates, HTML templates, or other rendering specifications. This allows issuers to define branded, consistent visual representations of their credentials. - Revocation
- The process of invalidating a credential before its natural expiration. Revocation can be checked through various mechanisms including status lists, revocation registries, or real-time status endpoints.
S
- SD-JWT (Selective Disclosure JWT)
- An IETF specification (RFC 9901) that extends JWTs to support selective disclosure. Claims are hashed in the JWT, and separate disclosure values allow holders to reveal only specific claims when presenting the credential.
- Selective Disclosure
- The ability for a holder to reveal only specific claims from a credential when presenting it, rather than sharing the entire credential. This is a key privacy feature in SD-JWT, mDoc, and ecdsa-sd-2023 formats.
- SIS (Student Information System)
- Software used by educational institutions to manage student data including enrollment, grades, transcripts, and graduation records. When integrated with credential issuance platforms, SIS systems can automatically trigger verifiable credential issuance upon events like course completion or graduation.
T
- Trust Anchors
- The root certificates or public keys that verifiers trust as authoritative sources. In the mDoc ecosystem, IACA certificates serve as trust anchors for mobile driver's licenses. Verifiers configure which trust anchors they accept, determining which issuers' credentials they'll validate.
- Trust Registry
-
A system that maintains lists of trusted issuers, their public keys, and the credential types they're authorized to issue. Trust registries enable verifiers to automatically determine whether to accept credentials from specific issuers without manual configuration.
See also
- TTL (Time To Live)
-
The duration for which cached data remains valid before requiring refresh. In credential verification, TTL settings balance freshness against performance—shorter TTLs catch revocations faster but require more frequent status checks. Bitstring Status List endpoints typically use TTL headers to enable edge caching.
See also
U
- UK Online Safety Act
- A UK law requiring platforms to protect users from illegal and harmful content, with specific duties around age verification for adult content. The act drives adoption of privacy-preserving age verification methods, including verifiable credentials that prove age without revealing identity.
V
- Verifiable Credential (VC)
-
A tamper-evident credential with authorship that can be cryptographically verified. Defined by the W3C Verifiable Credentials Data Model (v1.1, v2.0), VCs contain claims about a subject that are digitally signed by an issuer.
See also
- Verifiable Presentation (VP)
-
A tamper-evident presentation of one or more verifiable credentials. The holder typically signs the presentation to prove they authorized its creation and to bind it to a specific verification session.
See also
- Verifier
-
An entity that requests and validates verifiable credentials or presentations. Verifiers check the cryptographic signatures, issuer trust, credential status, and claim values to make authorization decisions. Examples include a bar checking age for alcohol purchases, an employer verifying a job applicant's qualifications, or an online service confirming identity for account access.
See also
W
- W3C (World Wide Web Consortium)
- The international standards organization for the web. W3C develops the Verifiable Credentials Data Model, DID specifications, and related standards that form the foundation of the verifiable credentials ecosystem.
- W3C VC 2.0
- Version 2.0 of the W3C Verifiable Credentials Data Model, the core specification defining how verifiable credentials are structured and represented. VC 2.0 adds support for multiple proof formats, improved status mechanisms, and better alignment with real-world deployment patterns.
- Wallet
-
Software (typically a mobile app) that stores, manages, and presents verifiable credentials on behalf of a holder. Wallets handle the cryptographic operations for receiving credentials from issuers and creating presentations for verifiers.
See also
X
- X402
-
An emerging standard building on HTTP 402 Payment Required for web-native micropayments. X402 extends payment protocols with support for stablecoins and modern payment rails, enabling websites and APIs to request payment directly in HTTP responses without redirects or third-party payment pages.
See also