Skip to main content

How to Revoke a Credential

This guide walks you through the process of revoking a credential using Skippy's platform.

Prerequisites​

Before you begin, ensure you have:

  • An issued credential with status metadata
  • Access to the project where the credential was issued
  • Appropriate permissions to revoke credentials

Step-by-Step Process​

Step 1: Navigate to Credentials​

  1. Log in to your Skippy dashboard
  2. Select the project containing the credential you want to revoke
  3. Click on "Credentials" in the navigation menu

Step 2: Locate the Credential​

You can find the credential using several methods:

Option A: Search by Email​

  • Use the search bar at the top
  • Enter the recipient's email address
  • Press Enter or click the search icon

Option B: Filter by Status​

  • Use the status filter dropdown
  • Select "Completed" to see issued credentials
  • Browse the filtered list

Option C: Filter by Template​

  • Use the template filter
  • Select the credential type
  • Find the credential in the filtered results

Step 3: View Credential Details​

  1. Click on the credential row to open the details page
  2. Review the credential information:
    • Recipient: Email and personal information
    • Issue Date: When the credential was issued
    • Status: Current credential state
    • Template: Credential type and attributes
    • Status List Info: List ID and index (if available)

Step 4: Verify Status Metadata​

Before revoking, confirm the credential has revocation metadata:

Status list: sl_abc123#42

If this information is missing, the credential cannot be revoked through the status list mechanism.

Step 5: Initiate Revocation​

  1. Scroll to the "Credential Lifecycle" section
  2. Click the "Revoke Credential" button (red button)
  3. A confirmation dialog will appear

Step 6: Confirm Revocation​

The confirmation dialog shows:

  • Credential details for review
  • Warning that revocation is permanent
  • Impact on future verifications

To proceed:

  1. Review the information carefully
  2. Click "Confirm" to revoke
  3. Click "Cancel" to abort

Step 7: Verify Revocation​

After revocation:

  1. Status updates immediately to "Revoked"
  2. Timestamp recorded showing when revocation occurred
  3. Status list updated with the new revocation bit
  4. UI reflects the revoked state with a red badge

You can verify the revocation by:

  • Checking the credential details page
  • Viewing the "Revoked At" timestamp
  • Confirming the status list bit is set to 1

What Happens Next?​

Immediate Effects​

  • Verification fails instantly for this credential
  • Status list cache invalidated globally
  • Revocation recorded with timestamp and user
  • Cannot be undone - revocation is permanent

For the Holder​

  • The credential remains in their wallet
  • Attempting to present it for verification will fail
  • Some wallets may display a "Revoked" indicator
  • They should be notified of the revocation (if you have a process)

For Verifiers​

  • Any verification request checking this credential will fail
  • The status list indicates revoked status
  • Verification response includes revocation information

Common Scenarios​

Revoking Multiple Credentials​

If you need to revoke multiple credentials:

  1. Repeat the process for each credential
  2. Consider using the API for bulk operations
  3. Keep a log of revocations for audit purposes

Revoking Due to Security Breach​

For urgent security revocations:

  1. Revoke immediately without delay
  2. Document the reason in your audit log
  3. Notify affected holders
  4. Review related credentials that may also be compromised

Revoking Expired Credentials​

Even if a credential has expired:

  • Revocation provides explicit invalidation
  • Useful for audit trails
  • Prevents edge cases where expiration is ignored

Troubleshooting​

"Cannot Revoke" Button is Disabled​

Possible reasons:

  • Credential already revoked
  • No status metadata present
  • Insufficient permissions
  • Credential was not issued with revocation support

Solution: Verify the credential was issued after status list implementation was enabled.

Revocation Appears Slow​

What's happening:

  • Status list update is instant
  • Cache invalidation may take seconds
  • CDN propagation can take up to 5 minutes

Solution: Wait a few minutes and check again. The revocation is effective even if not immediately visible everywhere.

"Status List Not Found" Error​

Possible causes:

  • Status list was deleted or corrupted
  • Network connectivity issue
  • Service temporarily unavailable

Solution: Contact support if the issue persists.

Best Practices​

Before Revoking​

  1. Verify you have the correct credential - double-check recipient information
  2. Document the reason in your internal systems
  3. Notify the holder if appropriate for your use case
  4. Consider the timing - immediate vs. scheduled revocation

After Revoking​

  1. Verify revocation succeeded - check the UI confirms revoked status
  2. Update internal records - mark the credential in your database
  3. Communicate with stakeholders - inform relevant parties
  4. Monitor for issues - check for verification attempts

Record Keeping​

Maintain records of:

  • When credentials were revoked
  • Who performed the revocation
  • Reason for revocation (in external system)
  • Any related incidents or tickets

API Alternative​

For programmatic revocation, use the API:

POST /api/statuslist/{listId}/revoke
Content-Type: application/json

{
  "idx": 42
}

See the API Reference for complete documentation.

Next Steps​