Changelog

2.1.0 19 October 2026

Added

• Export a key as a passphrase-protected file. The key stays in the wallet. Controllers approve with their secrets, the same way they approve a signature. Only the person who started the export can download the file, and only until the request expires. Company administrators can start an export
• When adding a key, choose Generate or Import. Import uses the exported file and its passphrase, shows the signature and key type from the file, and fills the identifier from the file name. The person who imports the key can be left out of the controller groups
• Delete a key from an identity. Controllers approve, and the page warns that the deletion cannot be undone. The key is removed from the identity. Credentials signed with it can no longer be verified, and the key can no longer sign or change their status. Company administrators can start a deletion

Changed

• The keys guide explains export, import, and deletion
• Manage Key Access lets you remove yourself from every controller group. A warning says you lose access when the request completes, and that you can still use the key until then
• A pending change to who may use a key is labeled Key Management Request in the bell and on the dashboard. A new controller’s key file uses the same download name as when a key is created
• Requests in the bell and on the dashboard use the same row, with a distinct mark for a new key, a signature, key management, a status change, an export, and a deletion. The dashboard request list is an open list, like Recent Activity

Fixed

• An empty secret on a key export or deletion no longer counts as another controller’s approval
• A message from the security module is shown on its own. The internal address is no longer added after it
• Pending requests in the bell keep their spacing

2.0.11 12 October 2026

Added

• A GS1 prefix or company prefix license that is signed in one step can revoke or suspend earlier licenses for the same license number, including the number written with or without a leading zero. The wallet updates an earlier license when it was signed with the same key and that status is still open
• Earlier licenses stay as they are when the new license still needs another person’s approval

Changed

• Credential search also matches a GS1 license number with its leading zeros removed

Fixed

• The guide’s public addresses for an identity, a credential, and a revocation or suspension list match the wallet. GS1 issuance steps match the forms

2.0.10 8 October 2026

Added

• Product documentation, including a guide for Global Office and Member Organisations on hosting the GS1 trust chain
• Dataspace credential exchange (off unless a deployment turns it on): request credentials and presentations, choose who may ask, and share a signing key with the dataspace
• One credential offer can be collected over OpenID or the dataspace. An offer can name the holder, or stay open until the first successful collection

Changed

• Documentation is split into a guide for people who use the wallet and a guide for administrators who set up access
• Notes in the documentation use icons instead of warning symbols
• The user guide explains keys as controller groups. Who may use a key is edited in one place, and the wallet applies the change
• The guide uses the current screen names: Identities, Generic Credentials, Credential Templates, and Company Settings in the account menu
• The GS1 hosting guide shows three hosting layouts as separate diagrams
• The hosting guide explains a user secret as the company’s second factor, and that a did:web identifier includes its domain. GS1 Global Office’s identifier is did:web:vc.gs1.org
• The keys guide explains a user secret as a second factor, separate from the private key that stays in the wallet
• Issuing a credential or a GS1 prefix license creates one offer for every exchange method that is turned on
• Offers are listed, opened, and deleted in one place
• Who may use the dataspace is edited in the wallet
• Starting a new credential signature requires permission to create a credential and to sign. People who only co-sign an existing request still only need permission to sign

Fixed

• A public credential keeps its JWT after the JSON-LD document for the same link has been requested
• Open offers stay visible in the offer list
• Dataspace presentation requests that use a presentation definition are reported as not yet supported
• Dataspace access tokens are checked in the order the specification requires

2.0.9 1 October 2026

Added

• Opening a public credential or status link in a browser can send the visitor to the verifier, when that option is on and the credential exists. Programs that request the credential document still receive it

Changed

• GS1 company prefix licenses again include the standard credential schema

2.0.8 30 September 2026

Added

• Creating a company requires its own permission. Administrators already have it

Changed

• Sign-in assigns a person to the company they are listed on, even when their email domain belongs to another company

Fixed

• After a company is created, updated, or deleted, the next request uses the current membership

2.0.7 28 September 2026

Changed

• Release images are also published for the GS1 Germany service platform

2.0.6 14 September 2026

Security

• Security update for the built-in API documentation

2.0.5 14 September 2026

Security

• Security update for the web server

2.0.4 27 August 2026

Changed

• A missing permission when adding a key is named in the error

Fixed

• Error messages show the reason returned by the wallet
• Approving a shared key no longer requires permission to create keys from every approver

2.0.3 25 August 2026

Security

• Security update for sign-in token handling

2.0.2 10 August 2026

Added

• GS1 prefix and company-prefix licenses can be offered for the holder to collect

Changed

• Those license forms can name the organisation and Party GLN before a licensee is chosen, when the license will be offered rather than issued directly
• OpenID credential exchange is off unless a deployment turns it on

Fixed

• Sign-in with GS1 Global Office accounts works with current access tokens
• The public offer list includes GS1 prefix and company-prefix licenses when the GS1 plugin is on

2.0.1 5 August 2026

Fixed

• Key requests succeed when an optional yes/no field is left out
• Deployed environments show the released version

2.0.0 4 August 2026

Changed

• Major platform upgrade. API error statuses are reported as text, such as 400 BAD_REQUEST

1.5.4 30 July 2026

Changed

• Credential subjects that are a web address or a DID can be opened from the list and the detail view

Fixed

• Copying a QR code works again
• Dashboard setup steps show their icons again

1.5.3 29 July 2026

Added

• Stronger browser protections on the wallet pages
• A Party GLN on the company, filled in when issuing GS1 prefix licenses
• GS1 key credentials ask whether the identifier is a GTIN, a GLN, or a Party GLN, and check the check digit
• Presentation requests can be scanned from a QR code

Changed

• Credential details, GS1 license forms, and presentation approval use clearer labels and a shared layout
• GS1 license forms find a licensee by name, DID, or Party GLN

Removed

• The outdated browser XSS header, replaced by the content security policy

1.5.2 24 July 2026

Added

• A shared link to a GS1 credential opens that credential on the same detail tab as other credentials

Changed

• Credential detail uses a quieter overview, proof, and audit layout

Fixed

• Switching to another credential version keeps the current detail tab
• Party GLN rejects spaces
• Audit entries for a key rearrangement show the key
• Credential search applies the status filter and the text search together
• Names taken from email addresses are capitalised

1.5.1 22 July 2026

Added

• An audit log with search and action filters. Each person sees their own activity; the audit permission shows the whole company
• Credential detail can verify a credential, change its status, and change whether it is on the public registry

Changed

• Signing and status approvals refresh on their own and show the credential under review
• The signing key list shows keys you control

Fixed

• Withdrawing approval of a status change completes
• Public credential issuance accepts the exchange protocol's own access token

1.5.0 21 July 2026

Added

• Personal API tokens on the profile, with the permissions you choose. The token is shown once, when it is created

Changed

• The profile is organised into account, permissions, and API token
• Visual refresh of the public website

1.4.0 20 July 2026

Added

• When adding a key, choose a single controller group or several groups that must agree

Changed

• Who holds a key is managed in one flow, with a review of the resulting groups
• Controller groups can be named
• GS1 search includes the license value, organisation name, and Party GLN

Removed

• Separate share and rearrange actions for keys

Fixed

• Dashboard “Issue a credential” opens the issue dialog
• Login provider logos stay square
• Saving a key file uses the browser’s save dialog
• Renaming a controller group does not ask the other holders to approve
• Adding a co-holder is treated as sharing that group
• You are warned when a change would remove you as a holder

1.3.14 7 July 2026

Fixed

• Deleting your key secret removes only your share, and only when someone else still holds that part of the key

1.3.13 6 July 2026

Added

• Optional names for controller groups
• When a GS1 license is issued to a company in this wallet, that company sees it in their activity

Changed

• Co-signing an existing credential request only needs permission to sign
• Key sharing uses one manage action
• Requests for a key secret expire after 15 minutes unless a shorter or longer time is chosen, within the configured maximum

1.3.12 1 July 2026

Changed

• Signing needs one secret from each controller group
• Changing who holds a key still needs every current holder to approve
• The key menu calls this “Manage key access”
• Public website copy and layout, including GS1 and European Business Wallet highlights

Fixed

• The identity list highlights a key file only when you hold that secret
• A key request shows that everyone has finished, without reloading the page

1.3.11 24 June 2026

Fixed

• The default verifier address is applied

1.3.10 24 June 2026

Fixed

• Credential links use the deployment registry address when a company has none of its own
• Review environments are removed when a merge request is closed

1.3.9 22 June 2026

Changed

• GS1 sign-in reads the role from the single role claim

Fixed

• GS1 administrator sign-in matches role names that contain spaces

1.3.8 19 June 2026

Security

• Security updates in the web page image

1.3.7 19 June 2026

Security

• Security updates on the build machines

1.3.6 19 June 2026

Changed

• Release images are built from a fresh base image

1.3.5 17 June 2026

Security

• Security updates to included libraries

1.3.4 5 June 2026

Added

• Sign-in requires a wallet role. A missing role is refused and you stay signed in to the identity provider

Changed

• After a presentation, the wallet follows the verifier’s redirect when one is provided

Fixed

• The login page shows the authorisation error
• Presentations use a JWT when both signature formats are allowed

1.3.3 1 June 2026

Security

• Security update of the application image

Fixed

• Presentations are addressed to the verifier named in the request, in the format that was asked for

1.3.2 1 June 2026

Changed

• An unknown sign-in role is named in the error

Security

• Credential-issuer discovery can be called from any website

1.3.1 21 May 2026

Security

• Security update for the web server

Fixed

• Collecting a credential accepts a proof addressed to the issuer’s web address or to the issuer’s DID
• Collecting a credential still finds the token address when the issuer does not publish one

1.3.0 5 May 2026

Added

• Issuers can hand out a one-time proof value for credential collection

Changed

• Breaking: Collecting a credential from another issuer uses the redeem action and returns the stored credentials as a list
• Breaking: Proof values are requested from the issuer, and are no longer taken from the token response
• Breaking: Signing uses the standard protected headers only
• Audit and identity lists are paged

Security

• Services run without administrator rights inside their containers
• Outbound credential and GS1 addresses cannot point at private or metadata hosts

Fixed

• Collecting a credential from another issuer completes for the person who started it

1.2.0 3 March 2026

Added

• Credential offers: create, show, delete, and a QR code
• The issuer publishes what it can offer, and where to ask for an access token

Changed

• Dashboard shortcuts open the matching action, including the GS1 license for your organisation type
• Pending requests refresh when the notification list is opened

Removed

• The old token address that did not include the issuer identity

Fixed

• A DID web name may use a subdomain of the company domain
• The issuer token address accepts form data, as the specification requires

1.1.10 30 January 2026

Fixed

• An unknown role returns no permissions, and you are not signed out

1.1.9 30 January 2026

Fixed

• A person who both approves and receives a key share can enter their secret
• An administrator can sign in when no company is assigned yet

1.1.8 29 January 2026

Fixed

• Sign-in accepts current access tokens, including GS1 accounts
• The login page stays in place when sign-in fails, so the error is visible
• GS1 credential lists show the newest first

1.1.7 28 January 2026

Added

• The profile shows your role and what each permission allows
• Each identity shows whether its DID can be resolved

Changed

• The wallet checks permissions, so role names can differ per deployment
• Company settings can be saved at any time; invalid fields are reported when you save

1.1.6 23 January 2026

Added

• Company settings: administrators manage every company, and a company administrator edits their own company

Changed

• A company needs at least one listed person or one email domain
• GS1 product data credentials always include revocation

Fixed

• The wallet stays up when a health check is slow
• A company can be updated when it has no person list or no domain list
• GS1 company-prefix licenses drop spaces from the fields you type
• Adding a key waits until the key file has been downloaded

1.1.5 22 January 2026

Fixed

• Simultaneous builds no longer overwrite each other’s images

1.1.4 22 January 2026

Changed

• A failed release restores the version files and does not create a release tag

1.1.3 22 January 2026

Changed

• Release images are published to the GS1 Global Office registry

1.1.2 22 January 2026

Changed

• Maintenance release

1.1.0 22 January 2026

Added

• EPCIS credentials in the GS1 plugin
• Claim a GS1 prefix or company-prefix license from the registry

Changed

• A key can be created without a personal secret file
• GS1 license credentials receive a revocation status when they are issued

Fixed

• Choosing “no user secret” on a pending key does not send a secret
• Several people can sign a GS1 credential together
• The key file check matches the file that was downloaded
• A sign-in token that is missing details shows a clear error

1.0.0 10 December 2025

Initial release of the Company Wallet.

Added

• Identities for organisations, with DID Web and DID Key, a public registry, and keys for authentication and signing
• Verifiable credentials, including templates, several signature formats, and signing by more than one person
• Shared control of keys, including splitting and rearranging who must approve
• Revocation and suspension of credentials
• Optional GS1 license credentials
• Sign-in with your organisation’s identity provider, and permissions per role
• Branding (name, logo, colours) supplied by the deployment
• An audit log of identity, credential, and key actions
• A web application for credentials, identities, and approvals