Tamper-Proof Digital Credentials: A Complete Implementation Guide

ISSUANCE FLOW:
┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  University │     │             │     │  Polygon    │
│   System    │────▶│   Anchora   │────▶│ Blockchain  │
└─────────────┘     └─────────────┘     └─────────────┘
       │                   │
       │                   │
       ▼                   ▼
┌─────────────┐     ┌─────────────┐
│  Graduate   │     │   Proof     │
│  Database   │     │   Storage   │
└─────────────┘     └─────────────┘

VERIFICATION FLOW:
┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Employer   │────▶│             │────▶│  Polygon    │
│  (Verifier) │     │   Anchora   │     │ Blockchain  │
└─────────────┘     └─────────────┘     └─────────────┘
       │                   │
       ▼                   ▼
┌─────────────┐     ┌─────────────┐
│  Verified!  │     │   Match!    │
│  or Forged  │     │  or Tamper  │
└─────────────┘     └─────────────┘

import VaaS from '@anchora/sdk';

const vaas = new VaaS({
  apiKey: process.env.ANCHORA_API_KEY
});

// Define the credential data
const credential = {
  // Credential metadata
  credentialId: 'CERT-2026-CS-001234',
  type: 'degree',

  // Issuer information
  issuer: {
    name: 'Stanford University',
    did: 'did:web:stanford.edu',
    department: 'School of Engineering'
  },

  // Recipient information
  recipient: {
    name: 'Alice Johnson',
    studentId: 'STU-2022-78901',
    dateOfBirth: '1998-03-15'  // For verification
  },

  // Degree details
  degree: {
    name: 'Bachelor of Science',
    field: 'Computer Science',
    honors: 'Magna Cum Laude',
    gpa: 3.85
  },

  // Dates
  enrollmentDate: '2022-09-01',
  graduationDate: '2026-06-15',
  issuedAt: new Date().toISOString()
};

// Anchor the credential
const result = await vaas.anchor({
  data: credential,
  collection: 'degrees',
  // Optional: encrypt sensitive data
  encrypt: true,
  encryptionKey: process.env.ENCRYPTION_KEY
});

console.log('Credential anchored!');
console.log('Hash:', result.hash);
console.log('Record ID:', result.recordId);
console.log('Status:', result.status);

// Output:
// Credential anchored!
// Hash: a3f5e8d9c2b1a4f6e7d8c9b0a1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0
// Record ID: 673d8f9a2c4e5f1a2b3c4d5e
// Status: QUEUED

// Webhook handler
app.post('/webhooks/anchora', async (req, res) => {
  const {
    type,
    hash,
    recordId,
    blockNumber,
    transactionHash,
    merkleProof,
    merkleRoot,
    anchoredAt
  } = req.body;

  if (type === 'ANCHORED') {
    // Update the credential with blockchain proof
    await db.credentials.updateOne(
      { hash: hash },
      {
        $set: {
          blockchainProof: {
            blockNumber,
            transactionHash,
            merkleProof,
            merkleRoot,
            anchoredAt,
            network: 'polygon'
          },
          status: 'VERIFIED'
        }
      }
    );

    // Send confirmation email to graduate
    await sendCredentialEmail(recordId);
  }

  res.status(200).send('OK');
});

function generateVerifiableCertificate(credential, proof) {
  return {
    // Human-readable information
    certificate: {
      id: credential.credentialId,
      recipient: credential.recipient.name,
      degree: credential.degree.name,
      field: credential.degree.field,
      issuer: credential.issuer.name,
      graduationDate: credential.graduationDate
    },

    // Verification data (machine-readable)
    verification: {
      // The hash of the original credential
      hash: proof.hash,

      // Blockchain proof
      blockchain: {
        network: 'Polygon',
        blockNumber: proof.blockNumber,
        transactionHash: proof.transactionHash,
        merkleRoot: proof.merkleRoot,
        merkleProof: proof.merkleProof
      },

      // Verification URL
      verifyUrl: `https://verify.stanford.edu/${credential.credentialId}`,

      // QR code data
      qrData: JSON.stringify({
        v: 1,  // Version
        h: proof.hash,
        b: proof.blockNumber,
        p: proof.merkleProof
      })
    }
  };
}

import VaaS from '@anchora/sdk';

const vaas = new VaaS({
  apiKey: process.env.ANCHORA_API_KEY
});

async function verifyCredential(certificateData, claimedCredential) {
  // Step 1: Verify the data hash matches
  const verification = await vaas.verify({
    // The credential data to verify
    data: claimedCredential,

    // Expected hash from certificate
    hash: certificateData.verification.hash,

    // Blockchain proof
    blockNumber: certificateData.verification.blockchain.blockNumber,
    merkleProof: certificateData.verification.blockchain.merkleProof
  });

  if (verification.verified) {
    return {
      valid: true,
      status: 'AUTHENTIC',
      message: 'Credential verified on blockchain',
      details: {
        anchoredAt: verification.anchoredAt,
        blockNumber: verification.blockNumber,
        transactionHash: verification.transactionHash,
        // Link to blockchain explorer
        explorerUrl: `https://polygonscan.com/tx/${verification.transactionHash}`
      }
    };
  } else {
    return {
      valid: false,
      status: 'TAMPERED',
      message: 'Credential has been modified or is fraudulent',
      warning: 'The provided data does not match the blockchain record'
    };
  }
}

// Example usage
const result = await verifyCredential(certificate, candidateCredential);

if (result.valid) {
  console.log('✓ Credential is authentic!');
  console.log('View on blockchain:', result.details.explorerUrl);
} else {
  console.log('✗ WARNING: Credential may be forged!');
  console.log(result.warning);
}

function VerificationPortal() {
  const [result, setResult] = useState(null);
  const [loading, setLoading] = useState(false);

  async function handleVerify(credentialId, dateOfBirth) {
    setLoading(true);

    try {
      const response = await fetch('/api/verify', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ credentialId, dateOfBirth })
      });

      const data = await response.json();
      setResult(data);
    } catch (error) {
      setResult({ valid: false, error: error.message });
    }

    setLoading(false);
  }

  return (
    <div className="verification-portal">
      <h1>Verify Credential</h1>

      <form onSubmit={handleSubmit}>
        <input
          type="text"
          placeholder="Credential ID (e.g., CERT-2026-CS-001234)"
        />
        <input
          type="date"
          placeholder="Date of Birth (for verification)"
        />
        <button type="submit">Verify</button>
      </form>

      {result && (
        <div className={`result ${result.valid ? 'valid' : 'invalid'}`}>
          {result.valid ? (
            <>
              <h2>✓ Credential Verified</h2>
              <p>This credential is authentic and has not been tampered with.</p>
              <a href={result.explorerUrl}>View on Blockchain</a>
            </>
          ) : (
            <>
              <h2>✗ Verification Failed</h2>
              <p>This credential could not be verified.</p>
            </>
          )}
        </div>
      )}
    </div>
  );
}

import QRCode from 'qrcode';

async function generateCredentialQR(credential, proof) {
  // Compact format for QR code
  const qrData = {
    v: 1,  // Version
    i: credential.credentialId,
    h: proof.hash.substring(0, 16),  // First 16 chars
    b: proof.blockNumber,
    u: 'https://verify.stanford.edu'
  };

  // Generate QR code as data URL
  const qrDataUrl = await QRCode.toDataURL(
    JSON.stringify(qrData),
    {
      width: 200,
      margin: 2,
      errorCorrectionLevel: 'H'  // High error correction
    }
  );

  return qrDataUrl;
}

// Mobile app scans QR and verifies
async function verifyFromQR(qrData) {
  const parsed = JSON.parse(qrData);

  // Fetch full credential from verification URL
  const credential = await fetch(
    `${parsed.u}/api/credential/${parsed.i}`
  ).then(r => r.json());

  // Verify hash prefix matches
  if (!credential.hash.startsWith(parsed.h)) {
    return { valid: false, error: 'Hash mismatch' };
  }

  // Verify on blockchain
  return await vaas.verify({
    hash: credential.hash,
    blockNumber: parsed.b,
    merkleProof: credential.merkleProof
  });
}

async function processGraduation(graduates) {
  console.log(`Processing ${graduates.length} graduates...`);

  // Create credentials for all graduates
  const credentials = graduates.map(student => ({
    credentialId: generateCredentialId(student),
    type: 'degree',
    recipient: {
      name: student.name,
      studentId: student.id,
      dateOfBirth: student.dob
    },
    degree: {
      name: student.degree,
      field: student.major,
      gpa: student.gpa
    },
    graduationDate: new Date().toISOString()
  }));

  // Batch anchor all credentials (Anchora handles batching internally)
  const results = await Promise.all(
    credentials.map(cred => vaas.anchor({
      data: cred,
      collection: 'degrees-2026',
      webhookUrl: 'https://university.edu/webhooks/anchora'
    }))
  );

  console.log(`Successfully queued ${results.length} credentials`);

  // Cost: 5,000 graduates = ~20 batches = ~$0.02 total!
  return results;
}

// Revoke a credential
async function revokeCredential(credentialId, reason) {
  const revocation = {
    type: 'REVOCATION',
    credentialId: credentialId,
    revokedAt: new Date().toISOString(),
    reason: reason,
    revokedBy: 'registry-admin'
  };

  // Anchor revocation to blockchain
  const result = await vaas.anchor({
    data: revocation,
    collection: 'revocations'
  });

  // Update local database
  await db.credentials.updateOne(
    { credentialId },
    { $set: { status: 'REVOKED', revocation: result } }
  );

  return result;
}

// Verify with revocation check
async function verifyWithRevocationCheck(credential) {
  // First verify the credential itself
  const verification = await vaas.verify({
    data: credential,
    hash: credential.hash,
    merkleProof: credential.merkleProof
  });

  if (!verification.verified) {
    return { valid: false, reason: 'TAMPERED' };
  }

  // Check revocation registry
  const revoked = await db.revocations.findOne({
    credentialId: credential.credentialId
  });

  if (revoked) {
    return {
      valid: false,
      reason: 'REVOKED',
      revokedAt: revoked.revokedAt,
      revocationReason: revoked.reason
    };
  }

  return { valid: true, status: 'ACTIVE' };
}