What is a Verifiable Credential?

A verifiable credential (or VC) is a unique, cryptographically signed proof of identity and verification. It's tied to a specific energy consumer and property, and is used as evidence to grant consent for that property.

When an energy consumer successfully verifies themselves using the Glow SDK, a verifiable credential (VC) is created against them. It's valid for 3 months from the date of creation.

This is an example of the VC object, as it appears in the data field of the GLOW_IDV_SUCCESS message (see the Implementation Guide page):

{
  "applicationId": "demo-id",
  "token": {
    "jwt": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ing1dFMyNTYtbldhNGc...",
    "jti": "vc_0wp0tBkXBDGj",
    "exp": 1791102043,
    "nonce": "2QJxMhn1U1pIhLAz",
    "mpan_hash": "Xgw7N8rE95GDgDXmW5nzH_w_UEYnI0Kvf8k203s1SD4"
  },
  "verificationId": "",
  "method": "document-upload",
  "timestamp": "2026-07-06T08:20:43.676Z",
  "subject": "test",
  "mpan": "1200000000000"
}

Field	Description
`applicationId`	The Glow application the VC was issued under.
`token.jwt`	The signed verifiable credential itself.
`token.jti`	Unique identifier for this credential instance.
`token.exp`	Expiry timestamp (Unix epoch seconds) — 3 months from issuance.
`token.nonce`	Random value used to prevent replay.
`token.mpan_hash`	A hashed reference to the associated MPAN.
`verificationId`	Reference for the verification event.
`method`	The verification method used.
`timestamp`	When the credential was issued.
`subject`	The identifier supplied for this energy consumer at SDK initialisation.
`mpan`	The meter point number the verification was performed against.

Confidentiality

The Verifiable Credential object contains no PII by itself. However, the JWT token it wraps can be decoded, and the decoded payload can contain identifiable information depending on what was supplied as the subject at SDK initialisation (e.g. an email address or name).

Example decoded JWT:

Because the decoded token can carry the subject value you supplied (and therefore potentially identifiable information), treat the VC as sensitive data — don't log it, expose it in client-side storage you don't control, or place it in a URL. See the next section for guidance on handling and storing a VC.

The VC serves as evidence of verification, and it is used to capture consent and onboard an energy consumer.

This process is covered on the following page: Consent Capture & Onboarding.

Developer's Note

The Glow Team are doing maintenance on the Consent APIs for the Glow SDK - as a result, this documentation and the related APIs are not publicly available at this time.

Verifiable Credentials

What is a Verifiable Credential?#

Confidentiality#

Using a Verifiable Credential for Capture Consent & Onboarding#

What is a Verifiable Credential?

Confidentiality

Using a Verifiable Credential for Capture Consent & Onboarding