👥 Verifiable Credentials with Auth0 and MATTR
Tags: security, identity
Published: 2021-07-01 13:48:35

#### 📚 How to issue Verifiable Credentials from Auth0 user data using #MATTR's #Auth0 Marketplace Integration.

### <br>
**TL;DR**: This blog post illustrates how to implement verifiable credentials using MATTR's Auth0 Marketplace integration. Our example features a fictitious university that issues digital credentials for students to use at various retail and hospitality locations—the university benefits by reducing the cost to produce and maintain physical ID cards. Students minimize PII (personally identifiable information) exposure with third-party organizations and the university (i.e., where their credentials are presented).

## The Target Scenario

ACME University, a (fictitious) prestigious educational institution, has been an Auth0 customer since late 2016. ACME uses Auth0 to store data about all its students and faculty and allow them to access many university applications. This includes the website that students use to enroll in courses at the beginning of the semester and the mobile app faculty.

![image1](https://images.ctfassets.net/23aumh6u8s0i/1FtcQ0edkKSJpY94sJ9Iw6/1fe32cc1beab2cb03a8707e2b03bd0ff/Diagram_1_v3.jpg)

ACME University has been issuing physical student cards since the 1980s so campus security can grant access to buildings and restricted parts of campus. Over the years, due to the university's strong community presence, many local retail outlets started accepting student cards to prove someone is a university student and give discounts. For example, some local coffee shops and bars offer discounts to university students but require a student card to get the deal. 

But not all places that offer student discounts are retail outlets. Many medical facilities offer discounts to university students, especially for doctor and therapist visits.

After conducting research about student access to technology, the university decided to phase out physical cards by the end of 2023 and instead issue **Digital Student Credentials**. ACME University believes this will help achieve the following benefits:

* **Reduce costs -** eliminate the need to print physical copies.
* **Improve security -** Digitally verifiable and expirable credentials reduce the possibility of being able to use fake or stolen physical credentials.
* **Improve branding -** The university believes students will prefer **Digital Student Credentials** as it modernizes campus life.

The team leading the effort has come up with the following requirements:

1. The university wants to issue **Digital Student Credentials** to its students, who will store those credentials on their phones. The **Digital Student Credentials** will be issued with student data stored in Auth0 and will contain: <br \>
a. First, middle and last name(s). <br \>
b. Date of birth <br \>
c. Degrees they are pursuing. <br \>
d. Picture <br \>
e. Date student began studying at the university. <br \>
f. Issuance date <br \>
2. **Digital Student Credentials** should no longer be valid when students are no longer enrolled at the university, for whatever reason (e.g., graduation, transfer, etc.).
3. As is the case today, students should be able to present the **Digital Student Credential** when physically present at various retail outlets and other establishments, but also when using a website or mobile application. 
4. These establishments want to ensure **Digital Student Credentials** are valid. For example, access to papers on certain academic platforms might be allowed only if someone is an ACME University student. Physical credentials typically have markings (seals, barcodes, etc.) for whoever looks at them to verify that the appropriate entity issued the credential. A similar mechanism should be available to verify these Digital Student Credentials are issued by ACME University.
5. The university should not know where or when students present **Digital Student Credentials**. For example, a student's medical situation should be kept private from the university.
6. As new shops and establishments in town are set up, **Digital Student Credentials** should not need to be reissued. For example, if a new coffee place opens in town, then all existing **Digital Student Credentials** should be valid.
7. To protect its students' privacy, the university wants to make it, so students have a choice to present some of the student data in a **Digital Student Credential** at shops, but not all of it. For example, a coffee shop only is interested in knowing the student is a university student to provide a discount, but not the student's name.
8. If students lose or have their phone stolen, they should report the fact to the university's IT department so they can mark the **Digital Student Credential** as invalid and issue a new one.

## A Potential Solution

[Read more...](https://auth0.com/blog/verifiable-credentials-with-auth0-and-mattr/?utm_source=content_synd&utm_medium=sc&utm_campaign=integration)