Verifiable Credentials (W3C VC)

QROS issues and verifies W3C Verifiable Credentials (VC Data Model 2.0) — digital identity cards, access badges, employee credentials, and membership credentials — signed with post-quantum cryptography. Each VC has a shareable link for public verification; the private key never leaves the browser, and an artificial intelligence workflow or a regulator can re-verify the proof without contacting your backend.

What QROS VCs include

• Identity fields — email, job title, works for, department, URL, telephone, address, country
• Photo + logo — subject photo and issuer logo embedded as data URIs (part of the signed credential)
• Credential types — BusinessCard, AccessBadge, EmployeeCredential, MembershipCredential, IdentityCard, Custom
• Expiration date — each VC has an expiration date
• Quantum-resistant signature — PQC keys (ML-DSA, SLH-DSA, Falcon) sign via oqs-provider
• Chain + revocation — the public verify page validates the issuer's certificate chain and checks CRL revocation

Public verification

Every VC has a shareable link (e.g., /v/{token}) that anyone can open — no login required. The public verify page shows the credential, its verification status, quantum posture, claims, proof, and images. The page validates the issuer's certificate chain and, if the issuing CA published a CRL, reports whether the credential is revoked.

What a Verifiable Credential looks like in QROS

The public verify page shows the credential with its signed claims, quantum posture, and chain validation: