Why a certificate is public but its download needs sign-in

Public verification lets anyone check the issuer's record. Downloading the certificate PDF, credential JSON or Open Badge is a separate action restricted to the authorized recipient and issuer staff. Possessing a serial or a public verification URL is not proof of ownership.

How recipients establish access

• Sign in with the confirmed email address the certificate was issued to.
• Verify that recipient address as an additional email on your Passport.
• Complete an approved claim for the individual certificate through its original recipient inbox.

Work through an access problem

1. Open the link in a browser where you are signed into the intended account.
2. Finish any required two-step sign-in challenge.
3. Check that your account's confirmed or verified address matches the issuer's recipient address.
4. If it went to another address, add that address or claim the certificate through Passport.
5. If you cannot access the old inbox, ask the issuer for an identity-checked address correction.
6. If you are issuer staff, check that you are a member of the approved issuing organization and are in the right workspace.

A not-found response can protect access

An unauthorized file request may return not found rather than expose additional information. That does not necessarily mean the public verification record has disappeared. Resolve your account and ownership relationship before treating a protected-download response as a missing certificate.

Current status still matters

Authorization does not make a withdrawn or replaced certificate current, and some file actions can be unavailable for historical or withdrawn records. Follow the status and the available controls. If you only need an employer to check the award, send the verification URL rather than the protected file URL.