The strongest branding is not a logo. It is your name where the signature is checked.

Your name: not a display field, an identifier

Most platforms let you upload a name and show it on a card. Here the name is the thing the cryptography resolves. A verifier takes the issuer identifier out of the credential, turns it into a URL under your domain, fetches your keys from it, and checks the signature against them. Your brand is not decorating that process — it is that process.

The consequence is the one that matters commercially: nobody can white-label you out of it later, and nobody can take it away, because it was never issued to you by us. It is your domain. We just sign under it.

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/jws-2020/v1"
  ],
  "id": "did:web:orbis.id",
  "verificationMethod": [
    {
      "id": "did:web:orbis.id#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "MupKZa26RgQMQasnNxv4eDIS7XzIpGfDA4a9Y4TJvYY", "y": "oo_fTfpVOyJSpQmS9VaMuby4WCi55pzDhd0BklllVYc" }
    },
    {
      "id": "did:web:orbis.id#key-2",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "53l5yME2Ut_Fx_S3wpCfN2lVCPaWOXheNxH4GZpj8Is", "y": "YIQijcuvassCjvvio3d7EuiRcGHYdMbZtFjf2huszck" }
    }
  ],
  "assertionMethod": ["did:web:orbis.id#key-1", "did:web:orbis.id#key-2"]
}

Your words: the labels a person actually reads

The second thing that carries your voice is smaller and more useful than a logo: the words on each field. A person opening a credential does not read a claim name like member_id — they read the label you wrote for it. Those labels are published, they are yours, and they are fetchable right now.

{
  "name": "ORBIS.ID",
  "did": "did:web:orbis.id",
  "types": [
    {
      "typeId": "iVita.Membership",
      "manifest": {
        "claims": [
          { "kind": "text", "name": "member_id",   "label": "Member number", "required": true },
          { "kind": "enum", "name": "tier",        "label": "Membership",    "required": true,
            "options": ["gold", "silver"] },
          { "kind": "date", "name": "valid_until", "label": "Valid until",   "required": true }
        ],
        "schema": "orbis.console.design/1",
        "authoredBy": "console"
      }
    }
  ]
}

Small, and worth more than it looks. "Membership" reads as a human word and tier does not, and the person holding the credential only ever sees the first one. That is most of what branding does on a document.

Your look: the part that is not in the wire yet

Here is the section a competitor would fill with a rendering of a credential in your brand colours. We are not going to, because the field that would carry those colours is currently empty and drawing the picture would be the lie the picture implies.

The issuance standard has a place for this. Issuer metadata can carry a display block — a name, a logo, a background colour, a text colour — and each credential configuration can carry its own. Measured on 2026-08-27, this cell publishes none of them.

curl -s https://id.orbis.id/.well-known/openid-credential-issuer \
  | jq '[.display // empty, (.credential_configurations_supported[].display // empty)] | length'

{
  "credential_issuer": "https://id.orbis.id",
  "credential_endpoint": "https://id.orbis.id/credential",
  "authorization_servers": ["https://id.orbis.id"],
  "batch_credential_issuance": { "batch_size": 10 },
  "credential_configurations_supported": {
    "iVita.Membership": {
      "format": "dc+sd-jwt",
      "vct": "iVita.Membership",
      "proof_types_supported": {
        "jwt": { "proof_signing_alg_values_supported": ["ES256"] }
      }
    }
  }
}

So what does a wallet show today? Your domain, your three labels, and its own default styling. That is genuinely less than you would want, and it is more than most of this industry can prove it delivers — which is not a defence, only a measurement.

What "your brand" would mean when the rest lands

Two things are missing and they are missing for different reasons, which is worth separating before anybody plans around either.

• The display block

  A place in a standard we already implement, currently unpopulated. Nothing has to be invented for it — the work is publishing the field and giving you somewhere to set it.

• Somewhere to set it

  Self-service administration is not built. Today the labels above were authored on our side, which is why authoredBy says console and not your organization's name.

• Something to render it

  A wallet a person installs from an app store. That is a register row of its own, and it is the reason a logo would have nowhere to appear even if you had set one.

None of that touches the first half of this page. The name is real now, it is checkable now, and it does not become more real when the colours arrive.

Read an issuer's whole public identity in three commands

Everything this page claims about branding is in three documents, none of which takes a key. Two of them will answer with content; the third will answer with a zero, and that zero is the honest part.

1. The name, and the keys it controls

   curl -s https://id.orbis.id/.well-known/did.json | jq .

2. The words a person will read

   curl -s https://id.orbis.id/manifest | jq .

3. The look — count it, and get zero

   curl -s https://id.orbis.id/.well-known/openid-credential-issuer \
     | jq '[.display // empty, (.credential_configurations_supported[].display // empty)] | length'

All three answered on 2026-08-27. If the third one ever answers with something other than zero for you, this page is stale and you should trust the command.

What is real about your brand here today.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers

Can I put my logo on a credential today?

No. The metadata field that carries a logo is published empty, and there is no screen where you could set one. When that changes it will change in the document above, and the command on this page will start returning something other than zero.

Does ORBIS appear anywhere on what I hand out?

Not in the credential and not in the verification path. The issuer identifier is your domain, the keys resolve from your domain, and the status list is served under your own subject. A verifier can check one of your credentials from end to end without ever learning who built the platform.

Do I need a new domain?

No — a path under one you already own is the normal case, and the shorter and more recognisable the domain, the better the branding. The name a person sees is the domain itself, so the choice is a brand decision more than a technical one.

Can I change the labels after credentials are out in the world?

The labels live in the manifest, not inside the signed credential, so changing them changes how new and existing credentials are displayed. The claim names underneath do not change, which is what stops a relabelling from breaking a verifier that was written against them.

Where do I see the schema behind these labels?

On credential types, which is this page's specification twin and prints the claim structure, the format and the worked example. The generated contract is here.