Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
e348db1
refactor: update address resolver documentation for TrustVC
manishdex25 Apr 30, 2026
dcc3baf
docs: enhance address resolver documentation for third-party integration
manishdex25 Apr 30, 2026
2ebd7ba
docs: enhance address resolver security and clarity
manishdex25 Apr 30, 2026
1a0196c
chore: update version to 0.0.1 in package.json
manishdex25 Apr 30, 2026
6049d15
Merge branch 'main' of github.com:TrustVC/TrustVC-Documentation into …
manishdex25 Apr 30, 2026
74417bf
docs: add security recommendations for address resolver API keys
manishdex25 Apr 30, 2026
7b0da45
docs: remove outdated security recommendations for address resolver A…
manishdex25 Apr 30, 2026
56d291a
Merge pull request #6 from TrustVC/TT-1342/address-resolver-documenta…
rongquan1 May 4, 2026
5f3b990
fix: rmeove identifier as per new sample requires name and address keys
manishdex25 May 4, 2026
1219265
Merge pull request #7 from TrustVC/fix/address-resolver-js-code
rongquan1 May 4, 2026
c361bcd
docs: add migration guide for decentralized renderer W3C VC support
manishdex25 May 5, 2026
59c9c7f
fix: handle FileReader error correctly in address resolver documentation
manishdex25 May 5, 2026
545dd2e
chore: update deploy-prod workflow to trigger on main branch push
manishdex25 May 5, 2026
e70bec1
chore: update deploy-prod workflow to trigger on main branch push
manishdex25 May 5, 2026
bb66e65
chore: update documentation and versioning for TrustVC
manishdex25 May 5, 2026
4acaa77
Merge pull request #9 from TrustVC/feat/rename-trustvc
manishdex25 May 5, 2026
73feafd
docs: update migration guide to reflect TradeTrust to TrustVC SDK tra…
manishdex25 May 5, 2026
1551d83
Merge pull request #10 from TrustVC/feat/revert-migration
manishdex25 May 5, 2026
fc7d24d
Merge pull request #8 from TrustVC/feat/renderer-migration
rongquan1 May 5, 2026
f8eee36
Update docs/how-tos/issuer/dns-did.md
manishdex25 May 7, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/common-issues/astron-address-whitelist-error.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,4 +13,4 @@ Error: processing response error (body="{\"jsonrpc\":\"2.0\",\"id\":56,\"error\"

To resolve this issue, ensure that your wallet address is whitelisted before attempting to transact on the Astron L2 network.

More information regarding the whitelist will be provided. For any inquiries or additional information, feel free to contact us at tradetrust@imda.gov.sg.
More information regarding the whitelist will be provided. For any inquiries or additional information, feel free to contact us via the [Official Page](https://trustvc.io/contact) or drop us an email at [tvc-support@dextech.ai](mailto:tvc-support@dextech.ai).
12 changes: 6 additions & 6 deletions docs/common-issues/cors-error.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,27 +5,27 @@ sidebar_label: CORS Errors on External Resources
keywords: ["cors", "cors error", "Access-Control-Allow-Origin", "cross-origin", "no-cors", "fetch blocked"]
---

When using the web-based verifier such as [ref.tradetrust.io](https://ref.tradetrust.io), the browser will block requests to external resources that do not have Cross-Origin Resource Sharing (CORS) enabled.
When using the web-based verifier such as [trustvc.io](https://trustvc.io), the browser will block requests to external resources that do not have Cross-Origin Resource Sharing (CORS) enabled.

:::info
This is not a bug in TradeTrust. It is a security feature of the browser that enforces access controls on the resources you host.
This is not a bug in TrustVC. It is a security feature of the browser that enforces access controls on the resources you host.
:::

## The Error

You will see this in your browser console (F12):

```text
Access to fetch at 'https://your-domain.com/context.json' from origin 'https://ref.tradetrust.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
Access to fetch at 'https://your-domain.com/context.json' from origin 'https://trustvc.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
```

## The Cause

The TradeTrust verifier runs entirely in the client's browser. When it tries to read a JSON-LD context or a revocation list from your server (`your-domain.com`), the browser checks your server's headers.
The TrustVC verifier runs entirely in the client's browser. When it tries to read a JSON-LD context or a revocation list from your server (`your-domain.com`), the browser checks your server's headers.

If your server does not return the header `Access-Control-Allow-Origin: *` (or explicitly allow `https://ref.tradetrust.io`), the browser acts as a gatekeeper and blocks the data from reaching the verifier.
If your server does not return the header `Access-Control-Allow-Origin: *` (or explicitly allow `https://trustvc.io`), the browser acts as a gatekeeper and blocks the data from reaching the verifier.

## Common Triggers in TradeTrust
## Common Triggers in TrustVC

These are the resources you host that frequently cause this error.

Expand Down
4 changes: 2 additions & 2 deletions docs/community/contributing.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,9 @@ title: Contributing
sidebar_label: Contributing
---

# TradeTrust Community
# TrustVC Community

Welcome to the **TradeTrust Community**! This page provides an overview of **TrustVC** and how you can contribute.
Welcome to the **TrustVC Community**! This page provides an overview of **TrustVC** and how you can contribute.

## Overview

Expand Down
4 changes: 2 additions & 2 deletions docs/glossary/glossary.md
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,8 @@ A new type of identifier designed to enable verifiable, self-sovereign digital i
[Learn more](https://www.w3.org/TR/did-core/)

### Document Store
A smart contract on the Ethereum network that records the issuance, revocation, and transfer status of TradeTrust Verifiable Documents. It enables the management of document validity and ownership transfers.
[Learn more](https://github.com/TradeTrust/document-store)
A smart contract on the Ethereum network that records the issuance, revocation, and transfer status of TrustVC Verifiable Documents. It enables the management of document validity and ownership transfers.
[Learn more](https://github.com/TrustVC/document-store)

### Ether
The native cryptocurrency of the Ethereum blockchain, used to power transactions and interact with smart contracts.
Expand Down
204 changes: 114 additions & 90 deletions docs/how-tos/advanced/address-resolver.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,64 +6,72 @@ sidebar_label: Address Resolver

Different companies may choose to use different pseudo-identity, some of these identifiers are reused and some are not. For those companies who chose to reuse a pseudo-identity, there is almost always a need to point to them again when doing transactions because it acts as an identifier to the user / company when doing transactions with them. Examples of such resources could be a shipping line wallet, multi-sig wallet or eBL token registry. Read more about identifier resolution framework <a href="https://github.com/Open-Attestation/adr/blob/master/identifier_resolution_framework.md" target="_blank" rel="noopener noreferrer">here</a>.

## TradeTrust's address resolution
## TrustVC's address resolution

For TradeTrust, currently there are 2 ways of resolving identities, 1 is through a local address book, the other is via 3rd party resolver API. These are accessible from the gear icon on the far right of the top navigation bar on TradeTrust website.
For TrustVC, currently there are 2 ways of resolving identities, 1 is through a local address book, the other is via 3rd party resolver API. These are accessible from the gear icon on the far right of the top navigation bar on the TrustVC website.

![Setting](/docs/topics/tradetrust-website/address-resolver/settings.png)
![Setting](/docs/reference/trustvc-website/settings-address-book1.png)

> You can refer to this [example](https://github.com/TradeTrust/address-identity-resolver) on how addresses get resolved on application end.
> For implementation reference, see the [TrustVC package](https://github.com/TrustVC/trustvc). The `@trustvc/trustvc` package is used for document verification and does not expose dedicated address-resolver APIs, so address resolution is configured and handled at the application settings layer.

## Address Book (Local)

Address Book is like a local phone book. The data is in a csv/excel format, where the minimal amount of columns are:
Address Book is like a local phone book. The data is in a csv/excel format, where the minimal required columns are:

- `identifier` (refers to the ethereum address)
- `name` (refers to the resolved name that the company defined in their csv/excel sheet).
- `Name` (refers to the resolved company or entity name)
- `Address` (refers to the Wallet address)

![Addressbook](/docs/topics/tradetrust-website/address-resolver/address-book.png)
![Addressbook](/docs/reference/trustvc-website/settings-address-book.png)

After importing the csv/excel sheet, previously ethereum addresses (where resolvable) should now be resolved to recognizable identities as defined within the imported sheet.

### Setup

So to recap the steps on setting your own local addressbook:

1. First, prepare a csv excel sheet list of addresses and identifiers. For example:
![local csv](/docs/reference/tradetrust-website/local-csv.png)
1. First, prepare a csv/excel sheet with `Name` and `Address` columns. For example:
![local csv](/docs/reference/trustvc-website/local-csv.png)
2. Develop an import csv file feature in your application. You'll need to:
- Convert file to string. For example:
```js
const readAsText = async (file: File): Promise<string> => {
return new Promise((resolve, reject) => {
const reader = new FileReader();
if (reader.error) {
reject(reader.error);
}
reader.onload = () => resolve(reader.result as string);
reader.readAsText(file);
});
};
```

```ts
const readAsText = async (file: File): Promise<string> => {
return new Promise((resolve, reject) => {
const reader = new FileReader();
reader.onerror = () => reject(reader.error);
reader.onload = () => resolve(reader.result as string);
reader.readAsText(file);
});
};
```
- Then convert string to key value object. For example:
```js
import { parse } from "papaparse";
const csvToAddressBook = (csv: string) => {
const { data } = parse(csv, { skipEmptyLines: true, header: true });
const addressBook = {};
data.forEach((row, index) => {
const identifierText = row.Identifier || row.identifier;
const addressText = row.Address || row.address;
addressBook[addressText.toLowerCase()] = identifierText;
});
return addressBook;
};
csvToAddressBook(readAsText);
```
3. Finally, if local address tally, return identifier name as per defined in csv file previously.

```ts
import { parse } from "papaparse";

const csvToAddressBook = (csv: string) => {
const parsed = parse(csv, { skipEmptyLines: true, header: true });
const data = parsed.data;
const addressBook: Record<string, string> = {};

data.forEach((row: any) => {
const nameText = row.Name || row.name;
const addressText = row.Address || row.address;
if (!addressText || !nameText) return;
addressBook[addressText.toLowerCase()] = nameText;
});

return addressBook;
};

const csv = await readAsText(file);
const addressBook = csvToAddressBook(csv);
```
3. Finally, if a local address matches, return the `Name` from your csv/excel file.

```js
const addressToMatch = "0xabc..."; // your local address
for (const [key, value] of Object.entries(csvToAddressBook)) {
for (const [key, value] of Object.entries(addressBook)) {
if (addressToMatch === key) {
return value;
}
Expand All @@ -72,59 +80,74 @@ So to recap the steps on setting your own local addressbook:

## Address Resolver (Third party)

For our reference implementation, we are using Google Sheets as our "database" for demonstrating the third party address resolution concept conveniently. Similar to local address book, think of it as a list of records that map ethereum addresses to a defined label name within the google sheet columns.
Third-party resolver lets you fetch address book entries from an external endpoint instead of importing CSV manually. Think of it as a remote address book that returns name/address pairs in JSON.

In the settings page you can add your third party address resolver. It enables you to add a third party's endpoint to resolve Ethereum addresses to their company's name. With Ethereum addresses being cryptic to end users, this Address Resolver will act as a digital address book, think of it as your mobile phone contact list, we only remember names, not numbers. The address book allows end users to see familiar identifiers such as `ABC Pte Ltd`. Once the Address Resolver endpoint has been added, when you verify a document with an identifiable Ethereum address, it will look like the following:
In the settings page you can add your third-party resolver endpoint to resolve Ethereum addresses to a company's name. With Ethereum addresses being cryptic to end users, this Address Resolver acts like a digital contact list where users see familiar identifiers such as `ABC Pte Ltd`. Once the endpoint is added and saved, resolvable Ethereum addresses appear with their resolved name:

![Address-resolved](/docs/reference/tradetrust-website/address-resolved.png)
![Address-resolved](/docs/reference/trustvc-website/address-resolved.png)

You can see that the company's name, resolver details and source will also be displayed above the resolved Ethereum
You can see that the company's name and resolver details will also be displayed above the resolved Ethereum
address.

_Note: There is a difference between "Resolved by" and "Source" parameters. Resolved by refers to the naming of the 3rd
party resolver that the user has set in the settings page. Source (an optional field) refers to information that is
verified by another party. For example, in NDI Myinfo, they have verified information from different agencies._

> You are not restricted to Google Sheets approach and is free to use any other backend solutions.

### How to set up a 3rd party Address Resolver (Google Sheet approach)

_Prerequisite: [Google sheets API](https://developers.google.com/sheets/api/reference/rest)._

- Go to [Google Console](https://console.cloud.google.com/apis/library) and create a new project.
![create project](/docs/reference/tradetrust-website/create-project.png)
- Enable Google Sheets API. Once enabled, it should be added to the enabled API list.
![enable api](/docs/reference/tradetrust-website/enable-api.png)
- Create an API key.
![create key](/docs/reference/tradetrust-website/create-key.png)
- Create and populate a Google Sheet with columns of:
- `identifier` (The ethereum address of the company)
- `name` (The name of the company)
- `source`. (_Optional:The source of the information_)
- Set Google Sheet to public.
- Setup the third party resolution service by configuring it to access Google Sheets with the API key gotten from step 1.
- Fork this [reference implementation](https://github.com/TradeTrust/demo-identifier-resolver).
- Define these environment variables in github repo secrets:
- SHEETS_API_KEY = Your created API key from Google Console.
- SHEETS_ID = Your google sheet ID.
- SHEETS_RANGE = Your google sheet cell range.
- STAGING_AWS_ACCESS_KEY_ID = Your AWS access key id.
- STAGING_AWS_SECRET_ACCESS_KEY = Your AWS access key secret.
- Spin up this service up by pushing to master, github actions will automate the deployment.
- Go to API Gateway in your AWS account. Create a custom domain name of your preference. Take note of API Gateway domain name.
![api gateway](/docs/reference/tradetrust-website/api-gateway.png)
- Click API mappings and configure it by selecting `stg-demo-identifier-resolver` from dropdown list.
- Go to Route53 and create a new CNAME record. The value is your API Gateway domain name.
![route53](/docs/reference/tradetrust-website/route53.png)
- Once set, wait for a few minutes and your API endpoint will be accessible in the custom domain name that you've created. This will be what we call the third party resolution service endpoint.
- Go to the website application, clicking the "+ Add" button in the settings page will show you following:

![Settings](/docs/topics/tradetrust-website/address-resolver/address-resolver.png)

- Fill in the following:
- `name` (A label you want to name this endpoint, this will be reflected as the "Resolved by")
- `endpoint` (The third party resolution service endpoint that you've spinned up)
- `API Header and API Key` (The authentication handling on service that you've spinned up)
### How to set up a 3rd party Address Resolver

#### 1) Create an endpoint that returns JSON

Your endpoint must return an array of objects with:

- `name`: display label (for example, company name)
- `address`: Ethereum wallet address

Supported response shapes:

```json
[
{ "name": "Alice Pte Ltd", "address": "0x1111111111111111111111111111111111111111" },
{ "name": "Bob Shipping", "address": "0x2222222222222222222222222222222222222222" }
]
```

or nested under one of these keys:

```json
{
"entries": [
{ "name": "Alice Pte Ltd", "address": "0x1111111111111111111111111111111111111111" }
]
}
```

```json
{
"results": [
{ "name": "Alice Pte Ltd", "address": "0x1111111111111111111111111111111111111111" }
]
}
```

#### 2) Host the endpoint

You can host it using either:

- **Simple**: static JSON file on a public URL (for example GitHub Pages, S3, or any static host)
- **Advanced**: API endpoint (for example Node/Express, Python/Flask, serverless functions)

For production, secure your resolver endpoint.

- If your endpoint is protected, configure an API header and API key in resolver settings (for example `x-api-key` + your token).

#### 3) Configure resolver in Settings

- Go to the website application. Click the `+ Add` button in the Settings page:

![Settings](/docs/reference/trustvc-website/address-resolver-empty-form.png)

- Fill in:
- `name` (label for this resolver; shown as "Resolved by")
- `endpoint` (the URL returning JSON entries)
- `API Header` and `API Key` (optional; use for protected endpoints, for example `X-API-Key` + `secret123`)

![Settings-filled](/docs/reference/trustvc-website/address-resolver-filled-form.png)

---

Expand All @@ -136,12 +159,13 @@ The "Name" input refers to the name of the address resolver that contains all th

#### Endpoint

The "Endpoint" input refers to the endpoint that will be called to resolve an Ethereum Address.
A demo hosted endpoint is available at [https://demo-resolver.tradetrust.io/](https://demo-resolver.tradetrust.io/).
The "Endpoint" input is the URL that will be called to resolve an Ethereum address.
Use the URL of your own deployed resolver service.
Example: `https://resolver.your-domain.com/api/resolve`.

![return-search](/docs/reference/tradetrust-website/return-search.png)
![return-search](/docs/reference/trustvc-website/return-search.png)

_Note: This demo endpoint is not suitable for production environment, please use it only in testing or staging environment._
_Note: For production environments, host and secure your own resolver endpoint._

---

Expand Down
2 changes: 1 addition & 1 deletion docs/how-tos/advanced/wallet-management.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,4 @@ title: Wallet Management
sidebar_label: Wallet Management
---

For any signed transactions, a wallet private key is always needed. As of today, Tradetrust uses metamask browser extension as its wallet management solution. This [ADR](https://github.com/Open-Attestation/adr/blob/master/wallet_management.md#survey-of-key-management-solutions) provides a good background context on various key management solutions.
For any signed transactions, a wallet private key is always needed. As of today, TrustVC uses metamask browser extension as its wallet management solution. This [ADR](https://github.com/Open-Attestation/adr/blob/master/wallet_management.md#survey-of-key-management-solutions) provides a good background context on various key management solutions.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use stable wording and correct product capitalization.

At Line 7, use “MetaMask” (official capitalization) and avoid “As of today,” which can become stale in docs. A neutral phrasing is clearer long-term (e.g., “TrustVC uses the MetaMask browser extension…”).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/how-tos/advanced/wallet-management.md` at line 7, Replace the phrase "As
of today, TrustVC uses metamask browser extension as its wallet management
solution." with a neutral, correctly capitalized sentence such as "TrustVC uses
the MetaMask browser extension as its wallet management solution." Update the
"metamask" token to "MetaMask" and remove time-sensitive wording ("As of
today,") in the file content near the sentence referencing the ADR to ensure
stable documentation phrasing.

6 changes: 3 additions & 3 deletions docs/how-tos/bitstring.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,14 +201,14 @@ For the examples above, the Credential Status List is hosted at:
https://example.com/credentials/status/3

:::warning CORS Configuration Required for Interoperability
Your hosted Status List **must** have CORS enabled. This requires configuring the status list endpoint to return the `Access-Control-Allow-Origin: *` header. Without this configuration, external verifiers (like [ref.tradetrust.io](https://ref.tradetrust.io)) will be blocked by the browser's CORS policy and **cannot check if credentials are revoked or suspended**.
Your hosted Status List **must** have CORS enabled. This requires configuring the status list endpoint to return the `Access-Control-Allow-Origin: *` header. Without this configuration, external verifiers (like [trustvc.io](https://trustvc.io)) will be blocked by the browser's CORS policy and **cannot check if credentials are revoked or suspended**.

**Why this matters:**
- This only affects **web-based verifiers** running in browsers (like [ref.tradetrust.io](https://ref.tradetrust.io))
- This only affects **web-based verifiers** running in browsers (like [trustvc.io](https://trustvc.io))
- Server-side or native app verifiers are not affected by CORS
- Testing locally or within your own domain won't reveal this issue
- The error only appears when external web verifiers try to fetch your status list
- This is a browser security feature, not a bug in TradeTrust
- This is a browser security feature, not a bug in TrustVC
- Verification will fail or show warnings if the status cannot be checked

For detailed instructions on configuring CORS for your status list endpoint, see the [CORS Errors guide](/docs/common-issues/cors-error).
Expand Down
Loading
Loading