Incredify

How verification works

Why an Incredify badge can't be faked, in plain English — plus did:web, Open Badges 3.0, and the API.

A PDF certificate proves nothing — anyone with an image editor can produce one. The problem digital credentials solve is letting a stranger confirm a credential is real without contacting you.

The short version

  1. 1When you set up your organization, we generated a keypair: a private signing key (secret, encrypted, never leaves the server) and a public key.
  2. 2Your public key is published on the web at an address derived from your subdomain, so anyone can fetch it.
  3. 3Every badge you issue is signed with the private key, producing a signature that could only have been made by the holder of that key.
  4. 4Anyone can fetch your public key and check the signature. If it matches, the credential genuinely came from you and hasn't been altered — not one character.

Why altering a badge is impossible rather than merely difficult

The signature covers the entire credential — recipient, badge name, criteria, date, evidence. Change any of it and the signature stops matching. There is no way to produce a valid signature without the private key, and the private key never leaves our servers in readable form.

did:web — your issuer identity

Your organization's identifier is did:web:incredify.net:issuers:<your-subdomain>. A DID is a decentralized identifier — an identity that doesn't depend on any single company's database. The did:web method resolves it to a document published on the open web, listing the public keys you sign with.

This is why the subdomain is permanent: it is part of your identity, and every credential you have ever issued points at it.

Open Badges 3.0

Credentials are issued as W3C Verifiable Credentials following the Open Badges 3.0 specification. That means they aren't locked to Incredify — any conformant verifier or wallet can read and check them. If you ever leave, your recipients' credentials keep verifying.

What a verification actually reports

  • Signature valid — issued by this organization and unmodified.
  • Not revoked — the issuer hasn't withdrawn it. This is why revoking beats deleting: the record stays checkable and honestly reports its status.
  • Not expired — where an expiry applies.

Verifying programmatically

Verification is a public endpoint. No key, no account:

Verify a credential

curl https://incredify.net/api/verify/<assertion-id>

Rate-limited to 60 requests per minute per IP address. The raw credential and the did:web document are also public:

Credential and issuer identity

curl https://incredify.net/api/assertions/<assertion-id>/credential.json
curl https://incredify.net/issuers/<your-subdomain>/did.json

did.json is a machine endpoint

/issuers/<slug>/did.json returns a JSON document for verifiers, not a page for people. Your human-facing public page is at /s/<slug> and <slug>.incredify.net — see Branding.

Related

What recipients getThe claim page, adding to LinkedIn, downloads, and the privacy control you hold on their behalf.Getting verifiedEarning the verified checkmark by confirming a work email address at your domain.APIIssue badges programmatically with a bearer token. Enterprise plan.

Still stuck?

Email us at hello@incredify.net — a human will answer.