VALID Authentic
credential certification.

Issuers

Credentials name your company as the issuer. Setting that up takes an application, an approval, and one DNS record.

Apply

Submit the form at /issuers/apply:

  • Your legal name and business number
  • The domain you control, which becomes your issuer identity
  • How you want that identity to sit on your domain, covered below
  • A contact name and email, which becomes your portal login
  • The training you deliver, and anything that helps a reviewer: a course catalogue, instructor qualifications, a sample certificate

valid.ca staff approve or reject every application. An application on its own grants nothing. A rejection comes with a written reason, and you can apply again once it is addressed.

What approval does

Approval runs once and sets up everything at the same time:

  • An Ed25519 signing key, generated by valid.ca and held encrypted
  • Your DID, either did:web:yourdomain.ca or did:web:credentials.yourdomain.ca
  • A DID document published at your domain, naming that key
  • An empty revocation list, signed and published at your domain
  • A portal account for your contact email, at /portal

Your issuer entry also appears in the signed trust registry at /.well-known/valid-issuers.json, which is what makes a credential verify as "Approved valid.ca issuer" rather than merely "signature valid".

Membership

valid.ca charges issuers a flat monthly membership, billed by card through Stripe. There is no per-credential fee.

Approval emails your contact a link to set a password. It works for seven days. After signing in, the portal opens on /portal/billing, and nothing else in it opens until the membership starts. Stripe's checkout takes the card, and when it confirms, the portal shows your first API key, once.

/portal/billing also links to Stripe's billing portal for changing the card, downloading invoices, or cancelling. If a payment fails, Stripe retries the card and issuing carries on in the meantime. If the membership ends, API keys return 402 and the portal goes back to billing until it restarts. Credentials you already issued keep verifying either way.

Your domain

Pick one of two modes on the application. Both end with verifiers resolving your public key from a host you control.

Credentials subdomain. Your DID is did:web:credentials.yourdomain.ca. Add one DNS record, a CNAME from credentials.yourdomain.ca to valid.ca, and you are done. That record is also what proves you control the domain. This is the easier choice and the default when you are unsure.

Root domain. Your DID is did:web:yourdomain.ca, so the credential names your main domain with nothing in front of it. Your web server has to reverse-proxy two paths to valid.ca:

https://yourdomain.ca/.well-known/did.json   ->  valid.ca
https://yourdomain.ca/status/1               ->  valid.ca

Forward the original Host header. valid.ca identifies you by the host on the request, so a proxy that rewrites it to valid.ca serves the wrong document. Proxy, do not redirect: DID resolvers are not required to follow a 301.

Nothing else needs proxying. Your OpenID4VCI credential issuer is https://valid.ca/i/{your-slug}. Its metadata, offers, and token endpoint all live on valid.ca, and wallets find them through the offer in the holder's email rather than through your domain.

API keys

Your first key appears when your membership starts. Create more in the portal at /portal/api-keys. The full key is shown once, at creation. After that the portal lists only its first twelve characters, so treat it like any other secret: store it where your application reads secrets from, and create a replacement rather than hunting for a lost one.

Keys do not expire. You can hold several at once, which is how rotation works: create the new key, deploy it, and stop using the old one.

Every key is scoped to your issuer account, so a key only ever sees and changes your own credentials. See the API reference for the calls themselves.

Issuing without writing code

The portal covers the same ground as the API for providers who are not integrating software:

  • /portal/credentials/create issues one certificate from a form
  • /portal/credentials/import takes a CSV for a batch or a backfill
  • /portal/templates stores a course once, with its name, description, criteria, and how many years it stays valid, so each certificate only needs the worker's details
  • /portal/credentials lists what you have issued, with a revoke button and a per-credential count of how often it has been checked

Suspension

valid.ca can suspend an issuer. While suspended, API keys return 403, the portal cannot issue, and the issuer drops out of the trust registry. Credentials already issued keep verifying, and their trust result falls back to "signature valid, issuer not recognized" until the suspension is lifted.

DNS must stay in place

Verifiers resolve your public key from your domain, for the life of every credential you have ever issued. Removing the DNS record or the proxy breaks all of them at once, including credentials issued years earlier.

If you leave valid.ca, keep the record. valid.ca hands over the public key material your old credentials need so you, or another operator, can keep serving it from the same URL.