For verifiers

Verifier Guide Verifier

Verifying a credential takes seconds and needs no contact with the issuer. This guide shows the three ways to verify, how to read the verdict and the checks behind it, and how to verify from the API.

On this page

Three ways to verify
Reading the result
What each verdict means
Verify via the API
Tips

Three ways to verify

Open the Verify module and provide the credential in any of these forms:

Verification token

Paste the token (e.g. VTKN-9F2A-7C13-A0E5) the holder shares.

Credential ID

Enter the credential's ID (e.g. CRD-4821).

Pasted JSON

Paste the full credential JSON the holder downloaded.

Scanning the QR on a credential resolves to the verification token, so it's the same path as the first option.

Reading the result

The result is one bold verdict plus the individual checks that produced it. A passing credential looks like this:

VALID Credential CRD-4821 · Course Completion · Acme University

Issuer signature is valid RSA-SHA256
Content hash matches SHA-256
Issuer DID is known did:blockid:7c9e…
Not revoked registry clear
Within validity window exp 2027-01-31

A failing credential keeps the same checks but marks the failing one with a red ✕ and changes the verdict accordingly:

TAMPERED The content doesn't match its signature

Content hash does NOT match mismatch
Issuer DID is known did:blockid:7c9e…

What each verdict means

Verdict	Meaning	What to do
VALID	Signature checks out, content is unaltered, issuer is known, not revoked, and within its validity window.	Trust it.
EXPIRED	Genuine and unaltered, but past its expiry date.	Ask the holder for a current credential.
REVOKED	The issuer explicitly revoked it via the revocation registry.	Do not trust it; request a new one.
TAMPERED	The content no longer matches its signature/hash — it was changed after issuing.	Reject it.
UNKNOWN_ISSUER	The signing DID isn't recognized by this BlockID instance.	Confirm you're verifying against the correct system.
NOT_FOUND	No credential matches the token / ID supplied.	Re-check the token or ID for typos.

Only VALID means "trust it." Every other verdict tells you exactly why the credential should be treated with caution.

Verify via the API

Use the credentials:verify scope with POST /api/v1/credentials/verify.php. Provide a token, a credential_id, or an inline credential JSON object.

cURL

curl -X POST https://example.com/api/v1/credentials/verify.php -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"token":"VTKN-9F2A-7C13-A0E5"}'

Example response

{
  "success": true,
  "code": "OK",
  "message": "Verification complete",
  "data": {
    "verdict": "VALID",
    "credential_id": "CRD-4821",
    "checks": {
      "signature_valid": true,
      "hash_matches": true,
      "issuer_known": true,
      "revoked": false,
      "expired": false
    }
  }
}

See the API Guide → verify for JavaScript and PHP examples and the status endpoint.

Tips

Prefer the token or QR for in-person checks — it's the quickest and least error-prone.
Pasted JSON is great for files a holder emailed you; the verifier recomputes the hash to detect any edits.
Read the checks, not just the verdict when something fails — they tell you precisely what went wrong.
UNKNOWN_ISSUER usually means wrong system, not a forgery. Confirm the BlockID instance.

No matching topics on this page.