Set up an issuer, define credential types and layouts, issue from a form, a CSV, or the API, and handle claims, resends, reissues, and revocations.

Issuing happens on Dashboard → Certificates → Issuer console. Issuers are teams: switch to a team workspace first (a team of one is fine), and a team owner or admin creates the issuer.

Set up the issuer

An issuer has a name, a slug (locked once verification is requested), a logo (PNG or JPEG), a website, and a one-paragraph description. The logo, name, and trust level appear on every certificate and verification page.

Request verification from the Overview tab once you can prove you control the issuer's domain: a page on it, a DNS TXT record, or an email on the domain. A person at OSINTverse reviews the request and the issuer's creator is told in the in-app inbox. Verification unlocks bulk issuing and the Verified mark.

Issuer trust	Certificates a month	Recipients per batch
Not verified	25	1 (single send only)
Verification in review	25	1 (single send only)
Verified issuer	2000	500
Verification declined	25	1 (single send only)
Suspended	cannot issue	cannot issue

Limit	Value
Active credential types per issuer	50
Per-recipient fields per type	6
Skill tags per type	8
Signatories per type	2
CSV file size	1 MB
Recipient name	120 characters
Recipient handle	60 characters
Personal message	300 characters
Issuer logo	2 MB, PNG or JPEG
Public verification reads	60 per minute per IP
Claim attempts	10 per minute per IP
Issued-certificates list page	100 rows
Certificates listed on a profile	50

Credential types

A credential type is the saved combination you issue from, for example "OSINT Fundamentals — Completion" or "Collective Oct'26 — Speaker". Issuing means picking a type and a list of recipients. Each type has:

Setting	What it does
Title and description	Shown on the certificate and the page. Changing them affects certificates issued from then on; signed records keep what they were signed with.
Layout	Landscape certificate (A4), portrait certificate (A4), or square badge (a social-sized card). The PDF and PNG follow the layout; the badge PDF is a square page.
Certificate id prefix	Optional. Letters and digits only; with a prefix such as `OSINTCOL1`, new certificates get ids like `OSINTCOL1-48213967` instead of `OVC-XXXX-XXXX-XXXX`. Already issued ids never change.
Style	One accent colour, a background (plain, ruled, grid), an optional footer line, and up to the signatory limit of names and titles.
Fields	Per-recipient values such as score, rank, hours, or track: a key, a label, a kind (text, number, date, URL), and whether it is required. Keys and labels that look like personal data (birth dates, ID numbers, addresses, phone numbers) are refused.
Skills	Tags from the OSINT skill taxonomy (geolocation, image analysis, breach data, cryptocurrency tracing, domains and infrastructure, people search, corporate records, verification, dark web, tooling, methodology). Stored in the signed record.
Allowed display modes	Which of name only, handle only, and name and handle the recipient may choose on the public page. Handle modes need a handle on the recipient row.
Validity period	Optional default expiry in days from the issue date. A row can override it.
Evidence link	A syllabus, scoreboard, or recording, shown on the page and stored in the record.

Archive a type to stop issuing from it; existing certificates are unaffected.

Issue

One at a time

The Issue tab's form takes a name, email, optional handle, optional issue and expiry dates, the type's fields, and an optional personal line for the email. Unverified issuers always issue this way.

From a CSV

Verified issuers upload a CSV. The preview checks every row before anything is issued: missing name or email, invalid email, bad handle, dates in the wrong format, invalid field values, duplicates inside the file, and recipients who already hold a valid certificate of this type (skipped unless you allow duplicates).

Download the template for a type from the Issue tab; it has these columns, reserved ones first:

Column	Required	Notes
`name`	Yes	Also accepted: `full_name`, `recipient`, `recipient_name`.
`email`	Yes	Lower-cased. Also accepted: `email_address`, `mail`.
`handle`	No	Leading `@` stripped; letters, digits, dots, dashes, underscores. Also accepted: `username`, `alias`.
`issued_at`	No	`YYYY-MM-DD`. Defaults to today. Also accepted: `issued`, `issue_date`, `date`.
`expires_at`	No	`YYYY-MM-DD`, after the issue date. Defaults to the type's validity period. Also accepted: `expires`, `expiry`, `valid_until`.
`message`	No	A personal line for this recipient's email. Also accepted: `note`.
one column per field key	Per field	Values are validated by the field's kind.

Commas, semicolons, and tabs are all accepted as delimiters; quoted cells and a BOM are fine. Unused columns are reported as warnings and ignored.

From the API

Trainers with their own site or LMS issue over REST with a team API key. See API.

What happens on issue

Issuing writes the batch and every certificate in one transaction: each row gets a public id, a signed record, a claim token, and an issued event. Then each recipient is emailed once (after the response is sent) with the issuer's name, the certificate title, your personal line, a View and download link to the verification page, and a claim link. The email has no open or click tracking. The outcome lands on the certificate as its email status (sent, failed, skipped), which the ledger and the API show.

The signing key is a server secret; if it is not configured, issuing answers 503 and verification keeps working.

Claiming

The claim link signs the recipient in with the magic link and attaches the certificate to the account that owns the email address it was sent to; another address is refused. Claiming unlocks the recipient's controls (display mode, listing on the profile, indexing) on Dashboard → Certificates. A certificate that is never claimed stays verifiable and downloadable; the page shows the display mode the type defaulted to.

Resending the email rotates the claim link, so only the newest email can claim.

After issuing

Action	Effect
Resend	Sends the email again with a fresh claim link. Only for unclaimed certificates.
Reissue	Fixes a typo in the name, email, handle, fields, or message by issuing a new signed record. The old one is marked `superseded` and links forward; the new one links back. If the email is unchanged and the old certificate was claimed, the new one is claimed by the same account.
Revoke	Marks the certificate `revoked` with a reason you can make public or keep private. The page keeps the record and shows the status, the date, and the public reason. Not reversible.

Every certificate has an event log: issued, emailed or email failed, bounced, complained, claimed, privacy changed, revoked, superseded.

Bounces and complaints

Delivery events come back from the email provider. A permanent bounce sets the certificate's email status to bounced with the provider's reason; a transient bounce (a full mailbox, a greylisting delay) leaves an event and keeps the status; a spam complaint is recorded on the certificate. The ledger and the API show the status, so you can fix an address and reissue.

Bounces and complaints also protect the sending domain every issuer shares. Over a rolling window, an issuer is suspended automatically when recipients file enough spam complaints, or when enough certificate emails went out and too large a share of them bounced permanently:

Rule	Value
Rolling window	30 days
Spam complaints that suspend	2 or more
Permanent bounce rate that suspends	10% or more
Certificate emails before the bounce rate counts	20 or more in the window

The issuer's creator gets an inbox note with the reason, issuing and email stop, and every certificate stays verifiable. Clean the recipient list, then ask OSINTverse to reinstate the issuer.

Caps and the kill switch

The monthly cap and batch size depend on the issuer's trust level (table above). The cap counts certificates created this calendar month, UTC, including reissues. OSINTverse can suspend an issuer (issuing and email stop, pages stay honest) and can pause issuing and claiming platform-wide for maintenance; verification never pauses.

Issuing certificates