What is a verification portal?
A verification portal is a public website, run by an ecosystem leader, where anyone can check a verifiable credential in a normal browser. UniMe, Impierce's open-source European Identity Wallet, uses it when a user shares a credential outside the wallet. The user posts a verifiable link, and the viewer sees the credential verified on screen without installing UniMe or subscribing to UniTrust.
Why share a credential outside the wallet?
Most of the people a credential matters to don't run a verifier. A recruiter reading a LinkedIn profile, a client checking a contractor's certificate or a colleague looking at a badge just wants to know that the credential is real. A verification portal gives them that answer in a browser, with the same signature and status checks a verifier would run, and without asking them to install anything.
For the user, the credential stays in UniMe and under their control. For the issuing organizations, every credential their ecosystem issues becomes checkable wherever the user shows it, on a page that carries the ecosystem's own name and branding. That is a strong reason to lead an ecosystem rather than only join one. How UniMe discovers ecosystems and shows them to the user is covered in Connections & Trust.
How does sharing from UniMe work?
Sharing takes a few taps. Today UniMe offers one share target, "Share to LinkedIn", in the menu of a credential's detail page. A general share option, for any platform, is planned.
- The user opens a credential in UniMe and chooses "Share to LinkedIn".
- UniMe finds the right portal. It resolves the issuer's OpenID Federation trust chain up to the trust anchor, the ecosystem leader, and uses that leader's verification portal.
- UniMe creates a data access consent token (DACT): a short signed statement, signed with the user's own wallet key, that allows the portal to fetch this one credential from its issuer for a limited time. UniMe stores the token at the portal and receives a verifiable link in return.
- UniMe opens LinkedIn's "Add to profile" page in the browser, prefilled with the credential's name, the issuer's name, the issue date, the expiration date if there is one, and the verifiable link as the certificate URL.
- The user confirms in LinkedIn. The certificate now appears on their profile with a link anyone can open.
UniMe keeps the verifiable link with the credential, so sharing the same credential again reuses the link instead of creating a new one.
What does the viewer see?
The viewer opens the verifiable link and lands on the ecosystem leader's verification portal. The portal asks for the viewer's consent, then fetches a copy of the credential from the original issuer, using the DACT the user created, and verifies it on screen: who issued it, to whom, what it states, and whether it is valid.
The viewer needs neither UniMe nor a UniTrust subscription. Because the portal fetches a fresh copy from the issuer each time, the viewer sees the credential's current state rather than a snapshot taken when the link was posted.
The portal is run by the ecosystem leader, not by Impierce and not by the issuer. The viewer verifies against a party that publicly vouches for the issuer, and the page carries the ecosystem's brand. The DACT is signed with the user's own key, so the user decides which credential becomes viewable, and no Impierce backend sees who shares what with whom.
What does UniMe require to share a credential?
UniMe can only create a verifiable link when the credential, its issuer and the issuer's ecosystem meet a few conditions. The table states them as UniMe checks them today.
| Requirement | Why | Status |
|---|---|---|
| The credential names the user's wallet as its subject | UniMe signs the DACT with the key that the credential is bound to, so an anonymous credential cannot be shared | Available |
The issuer is identified by a did:web | UniMe starts the OpenID Federation lookup from the issuer's domain | Available |
| The issuer belongs to an ecosystem with a trust anchor at the top | The trust anchor is the ecosystem leader whose portal hosts the link | Available |
| The ecosystem leader hosts a verification portal | The portal stores the DACT and serves the verifiable link | Available |
| Share to any platform, not only LinkedIn | A general share option that posts the verifiable link anywhere | Planned |
A credential that does not meet a requirement shows an error when the user tries to share it. The user can still present it from the wallet to any verifier over OpenID for Verifiable Presentations (OpenID4VP), because the requirements above apply to sharing outside the wallet only.
What does an ecosystem leader set up in UniTrust?
An ecosystem leader hosts its verification portal with UniTrust, Impierce's business wallet and credentialing platform. UniTrust is offered as software as a service and can also be self-hosted, and in both cases the portal runs under the leader's own domain and branding. Once the portal is live, every credential issued by a member of the ecosystem can be shared from UniMe, with nothing extra for the members to configure.
What matters for an organization that wants its credentials shareable is therefore to issue them from inside an ecosystem whose leader runs a portal. The organization can lead that ecosystem itself or join one that already exists. To learn how UniTrust runs ecosystems and portals, see the UniTrust documentation.
FAQ
Does the viewer need UniMe or UniTrust?
No. The viewer opens the verifiable link in any browser, consents, and sees the credential verified on the ecosystem leader's portal. No app, account or subscription is involved on the viewer's side.
Which credentials can a user share outside the wallet?
Any credential UniMe holds, in any of its supported formats, as long as it is bound to the user's wallet and comes from an issuer that belongs to an ecosystem with a verification portal. Self-issued credentials cannot be shared this way, because they have no issuer ecosystem to verify them.
Can a user share the same credential more than once?
Yes. UniMe stores the verifiable link with the credential and reuses it on later shares. The link stays valid for the lifetime of the DACT, which UniMe sets when it creates the token.
Does the credential leave the user's phone?
The credential itself does not. UniMe sends the portal only a signed DACT that names the credential and its issuer. The portal fetches its copy from the issuer when a viewer opens the link, so the issuer remains the source of truth for what the viewer sees.
Next steps
Read How does UniMe fit in the Impierce ecosystem? for who does what around the wallet, or go to the UniTrust documentation to set up an ecosystem and its verification portal.