Verification
Verifiable Credentials for the Digital Product Passport
What W3C Verifiable Credentials are, how they are used in a DPP and what turning supplier declarations into signed evidence actually gains you.
A Verifiable Credential (VC) is a cryptographically signed, independently verifiable digital statement. It is a W3C standard, and it is taking an increasingly central role in the DPP ecosystem.
How it works
There are three roles:
| Role | Function |
|---|---|
| Issuer | Creates and signs the statement (a certification body, for example) |
| Holder | Stores and presents the credential (the supplier) |
| Verifier | Checks the signature and content (you, or an authority) |
The verifier can validate the signature without querying the issuer online, which removes friction from the supply chain.
DPP use cases
- Certificates: GRS, GOTS or ISO documents issued as VCs verify in seconds.
- Supplier declarations: fibre origin or recycled content arrives signed. See collecting data from suppliers.
- Role attestations: a recycler's right to reach a restricted tier is proven with a VC. See access rights and roles.
- Passport data sets: role-specific packages served signed.
Relationship to the standards
FprEN 18246 lists W3C VCs among accepted signature approaches. UNTP defines all of its components — passport, facility record, traceability events, conformity credential — as VCs, and GS1 is moving to issue its own licence credentials as VCs. See EN 18246 and UNTP.
The identity side: DIDs
VCs are usually paired with decentralized identifiers: the issuer's identity is expressed as a DID and its keys resolve through it. See decentralized identifiers.
A practical start
You do not have to replace your infrastructure to move toward VCs:
- Structure evidence references first (document number, issuer, validity).
- Request new certificates in VC format.
- Sign your own passport versions. See eIDAS and signing.
- Offer a verification interface.
Frequently asked questions
Is blockchain required?
No. VCs work without one; what is needed is signing and key resolution.
My suppliers cannot issue VCs.
That is normal today. A signed PDF plus structured fields works during transition; require VCs in new contracts.
Do VCs contain personal data?
They can, in which case GDPR applies. Avoid carrying personal data in a product passport. See GDPR and DPP data.
