Issuer
An issuer is the organisation that creates and cryptographically signs a verifiable credential, for example a government agency, a bank, or a chamber of commerce, vouching for the claims it contains.
An issuer hands a signed credential to a holder over a protocol such as OpenID4VCI, and never needs to be contacted again when that credential is later checked: a verifier validates the signature against the issuer's public key instead. Under eIDAS 2.0, an issuer of qualified attestations must be listed on a national Trusted List, so any verifier can confirm it is authorised without a separate agreement per issuer. Issuing is a distinct role from operating a wallet or a verifier system: an organisation can hold all three roles, but the technical and legal obligations differ for each. As an issuer, it is responsible for keeping its signing keys secure, publishing a revocation status list so verifiers can check whether a credential is still valid, and defining the schema of the credential, which claims it contains and in what format, typically SD-JWT VC or an ISO mdoc. Because verification does not require contacting the issuer at the time of use, an issuer can go offline, change its infrastructure, or even cease operating a given credential type, as long as its public key and status list remain published for the credentials it already issued to stay verifiable. This separation between issuance and verification is what lets a credential be checked instantly, anywhere, without the issuer being part of every transaction.
Related terms
Does an issuer need to be online for a verifier to check a credential?
No. A verifier checks the credential's signature against the issuer's published public key and looks up its revocation status list, neither of which requires contacting the issuer directly. This is why an issuer can be offline or even stop operating a credential type while credentials it already issued remain verifiable, as long as the key and status list stay published.