Wallet Domain
By default your Business Wallet is served under a Credenco hostname, for example https://wallet.credenco.com. A wallet domain lets you serve the same wallet under a hostname you own, such as https://wallet.yourcompany.com.
The custom domain is an addition, not a replacement: the wallet stays reachable on its original hostname as well.
Why configure your own domain
Recognition and trust. Everything a counterparty sees carries your name instead of your provider's: the login screen, the wallet UI, credential offer links, and the QR codes people scan with their wallet app. A holder who is asked to accept a credential from wallet.yourcompany.com has an obvious reason to trust it.
did:web identifiers under your own domain. A did:web identifier is derived from the hostname that publishes it. With a wallet domain you can create identifiers such as did:web:wallet.yourcompany.com, so credentials you issue are cryptographically anchored to a domain you control, and verifiers can trace them back to your organisation through DNS and your TLS certificate.
Control over your own namespace. Credential offer URIs, status list URLs, and DID documents are all served from your hostname. Relying parties can allow-list your domain, and you are not tied to a provider URL in anything you have published.
- You need the Wallet domain (View) permission to see this screen, and Wallet domain (Change) to register, verify, or remove a domain.
- You must be able to create DNS records for the hostname.
- The final activation step is performed by Credenco Operations; you cannot complete it on your own.
Before you start
Pick a subdomain, for example wallet.yourcompany.com. A root (apex) domain such as yourcompany.com cannot be used, because DNS does not allow a CNAME record on an apex domain. If your DNS provider does not support CNAME on the hostname you want, look for an ALIAS or ANAME record type instead.
The hostname must be a domain you own, and it may not be a hostname belonging to the wallet provider.
Navigate to Wallet domain
Go to Settings → Wallet domain.
Step 1: register the hostname
Click Add. Fill in the Hostname field with the subdomain you want to use.
Click Save. The domain is created with status Pending and you are taken to its detail page.
Saving the domain does not change your existing identifiers. See Create a did:web identifier below.
Step 2: add the DNS records
The detail page shows the two DNS records you have to create at your DNS provider. Both values can be copied with the copy icon next to them.
| Type | Name | Value | TTL |
|---|---|---|---|
| TXT | _credenco-wallet.wallet.yourcompany.com | the verification token shown on the page | 3600 |
| CNAME | wallet.yourcompany.com | the wallet hostname shown on the page | 3600 |
The TXT record proves that you own the hostname. The CNAME record points the hostname at the wallet.
Many DNS panels treat the name field as relative to the zone and append the zone themselves. In that case enter _credenco-wallet.wallet rather than the full _credenco-wallet.wallet.yourcompany.com. If you get it wrong, the verification message tells you exactly which name the record was found at and what to enter instead.
Step 3: verify
Click Verify DNS. The TXT record is checked first, then the CNAME.
If a record is missing or wrong, the reason is shown above the table:
Fix the record and click Verify DNS again. DNS changes can take a while to propagate; if you just created the records, wait a few minutes before retrying.
When both records check out, the status becomes Verified and Credenco Operations is notified automatically. They add your hostname to the platform ingress, arrange the TLS certificate, and register the hostname with the identity provider. Once the hostname actually serves your wallet, the status changes to Active on its own.
You do not have to keep clicking Verify DNS. Newly registered domains are re-checked automatically every 30 minutes during the first 48 hours, and every domain is re-checked once every 24 hours after that.
Statuses
| Status | Meaning |
|---|---|
| Pending | Registered, but DNS ownership has not been proven yet. |
| Verified | DNS records are correct. Waiting for Credenco Operations to put the hostname into service. |
| Active | The hostname serves your wallet. Everything is done. |
| Failed | The DNS records no longer verify, for example because the TXT or CNAME record was changed or removed. Restore the records and the domain recovers automatically. |
The overview lists every registered domain with its status and the time it was last checked.
Step 4: create a did:web identifier
Registering a domain does not touch your identifiers. To issue or present credentials from the new hostname, go to Settings → Identifiers and create a new did:web identifier with the custom hostname as its domain.
Keep in mind:
- Existing identifiers keep working exactly as before, on their original hostname, for as long as that hostname stays configured.
- The domain must reach status Active before a
did:webidentifier that uses it can resolve. - Credentials and references issued under an old identifier do not automatically transfer to the new one.
- The wallet remains reachable on its original hostname; the custom domain is an addition, not a replacement.
Remove a wallet domain
Open the domain and click Delete. Confirm with Yes.
The hostname is immutable, so removing and re-registering is also how you change a domain.
A did:web identifier is published on its hostname. If you remove a wallet domain that a did:web identifier already uses, that identifier can no longer be resolved, and every credential ever issued with it becomes invalid: verifiers can no longer retrieve the DID document, so they cannot check the signature. The same applies if you delete the did:web identifier itself.
This cannot be undone by re-registering the domain later, because a new registration issues a new verification token and the identifier's keys are not restored. Only remove a wallet domain if no did:web identifier on it has been used to issue credentials, or if you accept that those credentials stop verifying.
Monitor domain status from your own systems
Status changes are published as an integration event, so you do not have to watch the screen. Subscribe to Wallet Domain Status Changed (v1) on an integration channel. It carries the hostname plus the previous and new status.