This section describes the philosophy and process for validating GS1 ID Key Credentials.

GS1 ID Key Validation Overview

A GS1 ID Key Credential provides proof that a GS1 MC has commissioned a specific GS1 ID Key, possibly with additional specificity like a specific batch/lot or specific serial number. The validation of a GS1 ID Key Credential requires verifying the integrity of the credential itself as well as validating that the Key Credential "extends" from a valid Credential. Validating a GS1 ID Key Credential provide cryptographic proof that the GS1 identifier has been issued in full conformance with the GS1 identification system and its governance.

GS1 ID Key Validation Rules

Denoting the GS1 ID Key Credential as K, K's credentialSubject id as D, and the credential referenced by K's extendsCredential property as P, the following steps MUST be performed to validate a GS1 ID Key Credential:

K MUST be a valid VCDM 2.0 credential document.
The signature of K MUST be valid and from a signing key referenced in the issuer DID.
CredentialStatus of L MUST be valid (see ).
K validFrom MUST NOT be in the future.
The credential document K MUST conform to the JSON schema https://id.gs1.org/vc/schema/v1/key.
D must be a GS1 Digital Link as defined in [[gs1-digital-link]]
If D contains a GS1 Digital Link with primary Key PK and no key qualfiers:
- P MUST be a valid GS1 License Credential.
- The issuer of K MUST match the subject of P.
- PK MUST begin with (as a string) the licenseValue from P.
If D contains a GS1 Digital Link with primary Key PK and one or more key qualifiers:
- The issuer of K MUST match the issuer of P.
- P MUST be a valid GS1 ID Key Credential.
- The primary key of P's credentialSubject id MUST equal PK.

Validating GS1 ID Key Credential

GS1 ID Key Validation Overview

GS1 ID Key Validation Rules

Key Validation Libraries and Tools