Credentials

Every credential in Glemo is a W3C Verifiable Credential 2.0 — Open Badges 3.0 is a profile of it. That means credentials are portable, tamper-evident and belong to their holder, not to a platform.

Anatomy

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
  ],
  "id": "urn:uuid:…",
  "type": ["VerifiableCredential", "OpenBadgeCredential"],
  "issuer": { "id": "did:web:university.edu", "name": "University" },
  "validFrom": "2026-01-01T00:00:00.000Z",
  "credentialSubject": {
    "id": "did:web:holder.example",
    "achievement": { "name": "Solidity 101" }
  }
}

Issuers and DIDs

Issuers are identified by a DID (did:web:university.edu), resolved to a public key published at their own domain (/.well-known/did.json). No central registry decides who can issue — the web of trust is the issuer's domain plus Glemo's verification layer.

Proof

Credentials are signed as VC-JWT (ES256). Any change to any claim breaks the signature. Personally identifiable information stays off-chain; only a hash/commitment can be anchored.

Revocation

Revocation uses the W3C Status List standard: a compressed bitstring served as a credential itself. One bit per credential — herd privacy included. See Verification for how verdicts are computed.