Roles
Every credential interaction has three parties: the issuer that signs a credential, the holder that keeps it, and the verifier that asks to see it.
| Role | Does | Example |
|---|---|---|
| Issuer | Signs credentials with its own key | A registry office issuing a PID |
| Holder | Stores them and decides what to disclose | A person with a wallet on their phone |
| Verifier | Requests specific claims and checks the signature | A shop confirming the customer is over 18 |
They are positions, not identities
The same organization is usually more than one. A bank issues account attestations, verifies its customers' identity credentials, and holds credentials of its own. What you are depends on which side of a given interaction you are on.
The pairing that never happens
Issuer and verifier do not talk. The verifier checks a signature and a trust chain; the issuer is not contacted and does not learn that the credential was used. Preserving that separation is most of what the protocols are for.
In LutraID an issuer and a verifier are separate configured entities, with separate keys and separately scoped API keys.