Frequently Asked Questions

What is the difference between an issuer template and a credential template?

An issuer template groups related credential templates under a single issuer identity. A credential template defines a single credential type - its format, attributes, validity period, and how the credential card is displayed. Every credential template belongs to an issuer template.

Which credential formats does the Business Wallet support?

Credential templates support SD-JWT VC, VC-JWT, and JSON-LD credential formats.

Can I issue a credential without integrating my backend?

Yes. From a credential template you can open the Issue tab and issue a credential directly from the UI, either to a web wallet endpoint or by scanning a QR code with a personal wallet app - useful for verifying a template end-to-end before wiring up backend integration.

What is the difference between an OAuth client and an API key?

Both grant an external system programmatic access to your wallet with a configurable set of permissions and an expiry date. An OAuth client uses the OAuth 2.0 Client Credentials flow to exchange a client ID and secret for a short-lived access token. An API key is a simpler Bearer token that is used directly, without an OAuth token exchange step.

Can I deploy the Business Wallet on-premise?

Yes. The Business Wallet can be deployed in your own Kubernetes infrastructure using the provided Helm templates, giving you full control over your data and deployment environment. This requires a Kubernetes platform, a PostgreSQL database cluster, Helm 3.8.0 or later, and an OAuth 2.0 identity provider (tested with Keycloak).

How do I get help or contact Credenco?

You can reach the Credenco team at info@credenco.com.

How do I revoke a credential I have already issued?

Create a credential status list and link it to a credential template before you issue the credential. Verifiers check the status list when they verify a credential, and revoking flips that entry so the credential is no longer accepted. Only credentials issued while the template was linked to a status list can be revoked; credentials issued without one stay valid forever.

What is a verifier template?

A verifier template (called "Receive credential configuration" in the UI) defines which credentials you want to receive from a customer in a single verification flow, for example the Deed of Incorporation, LPID, and Tax Registration Statement for a KYC onboarding flow. You can create a different template for each use case, then trigger a verification request from your backend whenever you need those credentials.

What is direct issue, and what is a trusted contact?

Direct issue pushes a verifiable credential straight into a Business Wallet without the holder scanning a QR code or tapping Accept, useful when provisioning a wallet during onboarding or when issuer and wallet already share enough trust. It only works from a trusted contact: an issuer that the receiving wallet has explicitly authorised, with a directIssueAllowed flag, to push credentials into it unattended.

What are catalog sources?

A catalog source is an external registry, such as Fides, WeBuild, or the EU catalogue (TS11), that publishes credential type definitions. Selecting a source on the Catalog sources screen makes its credential types available when you build issuer templates or verifier templates; deselecting it hides those types again without deleting anything already issued.

How do I get notified when something happens in my wallet?

Configure an integration channel - webhook, Kafka, JMS, or a custom adapter - and subscribe it to one or more event types from the event catalog. The wallet then pushes a signed CloudEvents message to your system as soon as the event happens, so you no longer have to poll the REST API. Every outbound message can be inspected in the Deliveries view, and failed deliveries can be replayed after fixing the receiver.

How do I control what different users in my organization can do?

Create authorization roles, each a named group of permissions, and assign them to users under Settings. Anyone assigned to a role inherits every permission it grants, so updating a role updates access for everyone who holds it - this is how you control what different users can see and do in the wallet.

What is a DID, and how do I manage signing keys?

A DID (decentralized identifier) is backed by a cryptographic signing key that the wallet uses to sign credentials and DID-based operations. You can import a key from a PKCS12 file or connect an external key management service such as Google Cloud KMS, with software or hardware (HSM) protection, so the private key never has to live inside the wallet itself.

What is the public profile?

The public profile is the identity other parties see when you share credentials or expose service endpoints. It holds your organisation's logo, name, contact details, and address, and lets you publish chosen credentials - for example a Chamber of Commerce registration - so a contact who looks up your identifier finds it already attached, without asking first.