Issuers are the organisations that check who someone is, once, and vouch for them from then on. You run the know-your-customer (KYC) verification, issue the credential and publish a live status root, and you are the only party that can ever link a credential back to a person, and only under due process. An issuer is admitted on chain by governance proposal (by the compliance council once it is seated) and posts a slashable bond; the first accepted issuer runs on the single-node production chain, in production since 20 September 2026 and operated by the CONECTIA group.
the seal
An issuer verifies a person once, issues the credential over OpenID for Verifiable Credential Issuance and publishes a signed status root at least every 30 seconds. The know-your-customer (KYC) evidence and the only link between a credential and a person stay in your custody, released only under due process; the chain sees signed roots, registry transactions and bond operations, never a person.
The issuer service is part of the main project, Apache-2.0. Its integration guide, the public routes, the request bodies and how a sandbox session’s outcome is chosen, is given on request: write to info@mintid.net and say what you are building, and it is yours.
Proves
Does not prove
Every claim of status on this page points at something public you can open or reproduce.
A recorded set of commitments. Each issuer is recorded on-chain as an institution: an identifier, an organisation-level name, its keys, its permitted grades, its authority state, its current status root and its bond. The chain holds you to those commitments.
Only KYC organisations admitted on chain by governance proposal (by the compliance council once it is seated) can issue credentials that verifiers accept. An issuer’s authority moves through a closed set of states — pending, active, enhanced monitoring, suspended, revoked — and the chain rejects any other transition.
You issue at grades A1 to A4 according to the strength of the verification, within the grades your admission allows. The grades are anchored on the low, substantial and high assurance levels of eIDAS, the EU regulation on electronic identification and trust services, and squared with ISO/IEC 29115, with enhanced due diligence as the step between substantial and high. Recency is a separate freshness band that you publish beside the grade; it is read on the classical seller rail and is not a presentation predicate. Validity defaults to 12 months for A1 and A2, 6 for A3 and 3 for A4, and a credential expires exactly when the verification behind it does, with no grace period; the way back is a new verification.
You publish a signed status root at least every 30 seconds. Verifiers check credentials against your latest finalised root, so a revocation enters your next root and is refused everywhere within the maximum root age, without revealing who a credential belongs to — and if your roots stop, your credentials fail closed within that same bound: 45 seconds at the reference values, 180 seconds on the single-node production chain.
A separately scoped emergency key lets you publish an emergency root at once, with strict ordering and rate limits. It is final after normal chain finality, reveals nothing about anyone, and its use is reviewed through governance (by the compliance council once it is seated).
An issuer locks a slashable bond before it can become active. In the protocol design, the compliance council, once seated, can suspend, sanction or slash an issuer through an evidence-backed decision with a public reason code; a slash that exhausts the bond suspends the issuer at once. Routine key rotation stays in your hands; the council steps in only to force a rotation when an operator key is lost or compromised.
You hold the encrypted KYC evidence and, for agents, the private accountability escrow — the only link between an agent credential and a human. That link is released only under due process, and never on-chain.
Everything that touches a person. Issuance and status live in your own off-chain services; the chain only ever sees signed roots, registry transactions and bond operations, never personal data, documents or the credentials themselves.
Credentials reach the holder’s software over OpenID for Verifiable Credential Issuance (OpenID4VCI), the protocol family of the EU Digital Identity Wallet.
An encrypted registry records whether each credential you issued is active, suspended or revoked — and the chain never sees a single entry.
The registry is condensed into a signed root at least every 30 seconds. Relayers may batch many issuers’ roots and pay the fees, but only your signature authorises a root.
Your identity-verification provider plugs in behind one neutral interface, so changing provider never touches the chain — and the grade remains your decision.
Signing keys, the emergency key included, stay in hardware-backed signers, so forging a root, a credential or a revocation would require breaking into the signer itself.
You pay admission, renewal and registry-lease fees, all governed parameters. You earn from your own KYC services and, for agent credentials, from the mint fee and lease fee.
The first accepted issuer is operated by the CONECTIA group, a related party of MintID. The first issuer and the first verifier were admitted through the same path the protocol offers anyone: a governance proposal, today voted by the chain’s single validator and, once the compliance council is seated, by the council; the same slashable bond; the same 30-second roots; all of it on chain.
Issuer admission runs through the compliance council once it is seated; until then it is a governance proposal voted by the chain’s single validator, and it starts as a conversation with the team. Talk to us about admission, permitted grades and bonding, or read how issuance, status roots and the registry fit into the protocol.