Skip to main content

Credential lookup

The credential lookup is a public search over the credentials your organization issued. Someone who does not have a credential's link or QR code, and only knows the recipient's name, identification number or email address, can find it there instead of writing to your team.

You publish it in one or two places, you decide what it can be searched by, and you decide what each result shows.

Credential lookup is a premium feature. If it is not enabled for your organization, the section shows "This feature is not enabled for your organization yet. Talk to your account manager to turn it on."

Before you publish​

Only the credentials a recipient made public appear. Visibility is the recipient's decision, not the issuer's: each person turns it on for their own credentials from their POK account. A credential the recipient keeps private is not returned by any search field. This is the most common surprise right after publishing, so read The search does not find a credential before assuming something is broken.

Only credentials issued with POK appear. Credentials imported from another system are not part of the lookup.

Your organization is responsible for the data it exposes. Before saving you confirm that your organization is legally responsible for the data shown publicly and has its recipients' consent. We recommend checking with your DPO under the applicable law (GDPR, LGPD).

You need an administrator or operator role. The "Organization Settings" item only appears in the menu for those two roles.

  1. In the top navigation bar, click your organization's name, then click "Organization Settings".

  2. Open the "Preferences" tab and find "Credential lookup" under "My preferences".

  3. Click "Configure".

  4. Under "Where do you want to publish it?", choose one channel or both:

    • "Organization page": a search section inside your POK profile. A "Look up a credential" link appears on your public organization page.
    • "iframe on your site": the same search embedded in your own website. This channel needs an authorized domain.

  5. Under "Search fields", choose what a visitor can type to find a credential: the recipient's full name, their identification number, or their email address. At least one has to stay on.

  6. Under "Result fields", choose what each result shows publicly: the recipient's full name, their identification number, their email address, the credential title, and a link to the credential, which opens the same public verification page its own link and QR code lead to.

  7. If you turned on the iframe, enter your site under "Authorized domain" and click "Add". Use a full https domain with no path, for example https://www.example.edu. You can authorize up to twenty domains, which is what most institutions need once you count the bare domain, the www version, and any microsite.

  8. Read the responsibility notice and accept it. Without it the configuration cannot be saved.

  9. Click "Save and publish".

Nothing is published until you save.

Add the search to your own website​

When you save with the iframe channel on, POK shows the code to paste under "Code to paste into your site". Copy it and paste it into any page of your site, wherever you want the search to appear.

You can copy the code again whenever you need it: open "Configure" in My preferences and click "View code".

The embed only loads on the domains you authorized. If the code is pasted anywhere else, the browser refuses to display it, so your search cannot appear under someone else's brand.

What a visitor sees​

A visitor fills in the fields you enabled and gets the answer right away.

  • The match is exact, though case and accents are ignored. "maria gonzalez" finds "María González", and repeated spaces make no difference. What has to match is the content itself: a name the credential records in full while the search box holds only part of it, or an identification number typed with dots or dashes when the credential has none, returns nothing. The search never works by approximation, so nobody can type a few letters and browse through your credentials.

  • If more than one field is filled in, all of them have to match. That is how two recipients with the same name are told apart.

  • Each result shows the credential title, the issue date, the expiration date when the credential has one, and the status, valid or expired. The fields you chose under "Result fields" are shown as well.

  • A revoked credential does not appear. Revoking a credential takes it out of the lookup, so the search never returns something your organization withdrew.

  • A very broad search is capped. When there are more matches than the search can return, the visitor is asked to add another detail to narrow it down.

  • An automated anti-bot check runs before each search, and results are not indexed by search engines.

Change what is published, or stop publishing​

Open "Configure" again, change what you need, and save. The change applies immediately.

To stop publishing, turn off both channels and click "Save". With no channel selected the button no longer reads "Save and publish". The search stops answering, the link disappears from your organization page, and any embed already pasted into a site shows an empty frame.

The search does not find a credential​

Work through these in order:

  1. The recipient has not made the credential public. This is the usual cause, especially right after publishing the search. Visibility is set by each recipient from their own account, so a catalog of credentials issued before you published the lookup starts out mostly invisible. It is worth telling your recipients that the setting exists and what it is for.

  2. The detail does not match the credential. Case, accents and extra spaces are ignored, so none of those is the problem. A name the credential records in full while the search box holds only part of it, or an identification number typed with dots or dashes when the credential has none, is enough for the search to return nothing.

  3. More than one field was filled in. All of them have to match at once. Searching by a single detail is the way to rule this out.

  4. The credential was imported, not issued with POK. Imported credentials are outside the lookup.

  5. The credential was revoked. Revoked credentials are removed from the lookup by design.

The iframe shows an empty frame​

  1. The domain is not authorized. The domain in "Authorized domain" has to match the site where the code is pasted, including https:// and the exact host. https://example.edu and https://www.example.edu are two different domains, so authorize both if you use both.

  2. The search is not published. If both channels were turned off, an embed that was already pasted into a page stops loading.