Configure Account-Level Identity Verification for a QCDS Sender

When the site is not enforcing Global Identity Verification, an authorized QCDS sender can configure a provider profile for that sender's own workspace/account. New Level 2 Requests created by that sender can then bind to the saved Didit or Shufti profile.

Open the Sender Settings

  1. Sign in to the QCDS frontend workspace.
  2. Open Settings.
  3. Find the Identity Verification section.

The sender must have permission to manage workspace settings. The account-level profile is scoped to the current workspace and signed-in Joomla user; it is not a site-global credential store.

If Global Identity Verification Is Active

When an enabled Global provider exists, QCDS shows that the site is providing Identity Verification. The sender's existing account-level credentials and enable preference are preserved but ignored, and QCDS does not allow the sender to save, test, or remove that account-level profile until Global Identity Verification is disabled.

Configure Didit or Shufti

When Global is not active, select the Provider and enter the matching values:

  • Didit: API Key, Workflow ID, and optionally the Didit Webhook Signing Secret. Copy the read-only QCDS Didit Webhook URL into Didit when webhook verification is being configured.
  • Shufti: Client ID and Secret Key.

Saved secrets are encrypted locally. Blank credential fields preserve existing stored credentials rather than erasing them.

Enable and Save the Profile

  1. Select Enable Account-Level Identity Verification.
  2. Click Save Identity Settings.

If provider credentials are present, the current QCDS frontend save action immediately tests the connection and reports the provider result. You can also use the separate Test Connection button later. A Trial/Test provider can remain selectable so you can exercise the complete Level 2 workflow before moving to production.

What the Profile Controls

An enabled, ready account-level profile is considered only when no enabled Global profile is overriding it. If selected for a new Level 2 Request, the exact provider profile is bound at send time. Later edits do not migrate an already-sent Request to a different provider.

Remove Credentials disables the profile and clears its provider credentials. If pending Level 2 participants are still bound to that profile, QCDS warns that verification will remain unavailable until suitable credentials are restored.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDS feature? Visit the QC Digital Signature Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.