The paper card that made Key to NYC’s digital pass work

The week

In the summer of 2021, New York City wanted people back in restaurants, gyms and theaters, and it wanted them there safely. The delta variant was driving a new rise in cases across the country. On August 3, 2021, Mayor Bill de Blasio announced the Key to NYC program. It required proof of at least one dose of a COVID-19 vaccine for workers and patrons at indoor dining, gyms and indoor entertainment venues. It was the first such requirement by a major US city.

The timeline was quick. The requirement took effect on August 16, with enforcement from September 13 after a period of education for businesses. In the space of a few weeks, restaurant hosts and gym receptionists across the city became, in effect, checkpoints.

Because the rule covered staff as well as customers, employers also had to collect and keep track of proof for their own workers. Children under 12 were not yet eligible for any vaccine, and the city’s health commissioner said it would consider reasonable accommodations for them. The city framed the weeks before enforcement as a period of education, with guidance and outreach to businesses rather than penalties.

The legal footing was still being tested. The vaccines then had only emergency use authorization, and the mayor pointed to a recent federal Justice Department view that this status did not prevent vaccination requirements. Full FDA approval of the Pfizer-BioNTech vaccine followed on August 23.

The interesting decision was what counted as proof. The city accepted several forms. Residents could show the paper CDC vaccination card, the small white card handed out at vaccination sites, or simply a photo of it. They could use the city’s NYC COVID Safe app, which stored a picture of the card. They could use New York State’s Excelsior Pass. Or they could show other official immunization records, including ones issued outside the city.

Excelsior Pass deserves a moment of explanation. Launched by the state in March 2021 and built with IBM, it produced a digitally signed, scannable credential from state immunization records. A credential is anything that proves something about you, like a driver’s license or a membership card. “Digitally signed” means the pass carried a kind of tamper-proof seal: a scanner could check, mathematically, that the state had issued it and nobody had altered it. By early August, the state said more than three million passes had been generated.

On August 5, the state launched Excelsior Pass Plus, a version built on the SMART Health Cards framework. A framework, or standard, is a shared rulebook that lets different systems understand each other. SMART Health Cards had been developed by the Vaccination Credential Initiative, a coalition of health and technology organizations that included the Mayo Clinic, MITRE and Microsoft. Several other states, including California, had begun issuing verifiable digital vaccination records using that standard, so a pass from one place could be checked by tools built elsewhere. The state also promoted the new pass for travel, through an airline’s health credential app.

Around New York, the picture was a patchwork. The White House had said in the spring that there would be no federal vaccine passport and no central federal database of vaccination status. Several states, including Florida and Texas, had moved to restrict vaccine passport requirements. Abroad, the European Union’s Digital COVID Certificate had been in use since July 1. Within days of New York’s announcement, San Francisco and New Orleans announced indoor vaccination requirements of their own.

State politics added turbulence. On the day Key to NYC was announced, the state attorney general released a report on harassment allegations against Governor Andrew Cuomo. He announced his resignation a week later, and Kathy Hochul became governor on August 24. The state’s credential program, like much else, changed hands mid-rollout.

The public debate that month was loud, and mostly about apps and mandates. Underneath it, New York had made a less noticed design choice that ended up mattering most: it kept paper.

Vaccine passes were among the most politically charged technologies of the pandemic, and the public argument was mostly about apps. For agency leaders, Key to NYC is more useful as a case study in credential design, because the same structure applies to mobile driver’s licenses, digital benefit cards, permits and professional licenses.

Any government credential has three parts that must work together: issuance, how the credential is created from an authoritative record; verification, how someone else checks it; and fallback, what happens for people the digital version fails. New York’s experience shows that the third part decided whether the first two could be imperfect without breaking the program.

The sections below start with a short primer on what a digital credential is, then take the three parts in turn. A hypothetical county permit program then shows the parts inside one organization, followed by where the same structure recurs, how to build from the back end out, and the questions to settle before launch.

What a digital credential actually is

Strip away the app and a digital credential is three things: a fact about a person, a source that vouches for the fact, and a way for a stranger to check the vouching.

The fact here was simple: this person received a COVID-19 vaccine dose. The source was the government’s immunization record. Every state keeps a registry, a large database where vaccination providers report the shots they give. New York City has its own as well, the Citywide Immunization Registry.

How the signature check works

The clever part is the checking. When the state issues a signed credential, it uses a secret digital key to create a signature that only it could have produced. Anyone with the matching public key, which the state publishes freely, can confirm the signature is genuine. The QR code on the phone, the square barcode a camera reads, carries the person’s details and that signature together. A verifier app reads the code, checks the signature and shows a result. No call to a central database is needed, and changing any detail breaks the seal.

In a SMART Health Card, the details inside the code are a compact health record in a common clinical data format: name, date of birth and the doses given, with dates and products. The issuer publishes its public keys at a web address named in the card. A verifier has to decide which issuers it trusts. In 2021 that meant relying on a directory of recognized issuers maintained by the standard’s backers.

That directory is a governance decision hiding inside a technical one. Whoever decides which issuers count decides whose credentials work. An agency that builds a credential program should know who maintains its trust list, how an issuer gets on or off it, and what happens to verifiers if the list changes.

Two ways to check: look it up, or check the seal

There are two basic designs for checking a credential. In the first, the verifier looks the person up in the issuer’s database at the moment of checking. That gives a fresh answer and lets the issuer revoke a credential instantly. It also needs a network connection at every door, and it tells the issuer where and when each person was checked.

In the second, the one SMART Health Cards used, the verifier checks the seal offline. Nothing is reported back to the issuer, and the check works in a basement bar with no signal. The price is freshness: a credential issued from a record later found to be wrong keeps working until it expires or the verifier learns otherwise.

Neither design is right in general. A one-time door check for dining favored the offline model, because privacy and speed mattered more than revocation. A credential that grants access to money, or that may need to be withdrawn quickly, may justify an online check despite its costs.

What a photo of a card cannot do

Compare that with a photo of a paper card. The photo shows what the card says, but nothing proves the card is real. Anyone with a printer can make one that looks right. The paper card is a statement; the signed pass is a statement with a notarized stamp on it.

What the signature cannot tell you

One subtlety is worth holding on to. A signature proves that the issuer vouched for the record. It does not prove the record was right in the first place. If the registry holds a wrong name or a missing dose, the signed pass will faithfully carry that mistake, or fail to appear at all. Cryptography, the mathematics behind the seal, protects data against tampering; it cannot fix data that was wrong at the source.

Two further limits matter. The pass carried no photo, so it proved that a vaccinated person existed, not that the person at the door was that person. That is why venues were told to check photo ID as well. And because the check worked offline, a verifier could not learn that a record had since been corrected. The strength of the seal was real, but much of the real work lay behind the app rather than inside it, as the next section shows.

Standards like SMART Health Cards matter because they make the stamp portable. If every state invented its own format, a restaurant would need a different scanner for every state. With a common standard, one verifier can read passes from any participating issuer.

Issuance: the registry is the product

A digital vaccination credential is only as good as the record behind it. Excelsior Pass drew on the state’s immunization information system and New York City’s registry. When a resident’s record was complete and their name and date of birth matched, a pass appeared in minutes. Some records were incomplete or carried a typo. Others reflected a dose given in another state, at a federal site or abroad. In those cases the resident got an error message and had to seek a correction from a provider or the health department.

How matching fails

Take a resident who got her shot at a busy mass vaccination site where a volunteer typed her birthday with the month and day swapped. Every time she asks the app for a pass, the details she enters do not match the record. The app is working perfectly. The record is wrong, and the app has no way to know which is right.

The failure modes are predictable. Names are entered differently by different providers: hyphenated surnames, middle names, nicknames, transliterations. Dates of birth are swapped or mistyped. Some doses never reach the registry, for example when given by a provider that reports elsewhere or in another country. People vaccinated across a state or city line may appear in the wrong registry. Each of these produces the same thing for the resident: an app that says no.

That pattern is general. The user experience of a digital credential is set by the quality of the underlying records and the speed of the correction process, not by the app’s interface. An agency launching a credential should measure, before launch, what share of eligible residents have a record that will match, and staff a correction channel sized for the rest.

Corrections are a service, not a footnote

Corrections need a clear owner. A resident told to “contact your provider” about a mass vaccination site that has closed has nowhere to go. The correction channel should say what evidence it accepts, such as the paper card or a pharmacy record, who can approve a change and how long it takes. It also needs a way to handle doses given outside the jurisdiction, which no local provider can fix.

Where corrections live depends on the issuer. A state health department running a statewide registry can fix records centrally but may be far from the resident. A city health department is closer to residents but may depend on the state for the credential itself. In New York, with both a city and a state registry, the two had to agree whose record governed. Any program built on more than one source of truth inherits that question.

The city’s own app showed the opposite trade-off. NYC COVID Safe let users store a photo of their card, which was easy for anyone to use but verified nothing. Issuance without an authoritative record is convenience, not a credential.

Sizing the correction workload before launch

The workload can be estimated before a single resident complains. Take a sample of eligible people whose details are known, such as staff volunteers, and run them through the matching process. The failure rate in that sample, applied to the eligible population, gives a first estimate of how many corrections will arrive. Demand will also come in waves, around each policy announcement and enforcement date, so staffing should follow the calendar.

The correction channel is also a security risk. If anyone can call and have a dose added to a record, the channel becomes the easiest way to obtain a genuine, signed credential for a person who was never vaccinated. Corrections therefore need their own evidence rules and spot checks. The weakest path into the registry sets the true assurance of every credential issued from it.

Binding the credential to the right person

Issuance also has to bind the credential to the right person. Retrieving a record by matching a handful of personal details is quick, but anyone who knows those details can retrieve it too. Identity proofing is the process of confirming someone is who they claim to be before handing them a credential, from answering a few questions up to showing ID in person.

Federal guidance gives a vocabulary for that choice. NIST’s digital identity guidelines describe identity assurance levels, from self-asserted identity up to evidence checked remotely or in person. Stronger identity proofing at issuance raises assurance and cuts uptake, especially among people with thin credit files, no fixed address or no current ID. Each agency has to choose that balance deliberately for its credential, and write the choice down, instead of inheriting it from a vendor’s default flow.

Verification: businesses as reluctant checkpoints

Verification fell on private businesses. Restaurant hosts, gym receptionists and theater ushers became the people checking credentials, usually alongside a photo ID. They had seconds per customer, no training in document fraud and every commercial incentive to avoid confrontation.

Why staff glance instead of scan

Consider a Friday night at a busy bistro. A line of twelve people is waiting, the host is also answering the phone, and a regular is holding up a phone screen while chatting about her week. The host has a scanner app installed. Does she use it on every guest? Realistically, she glances, smiles and seats them.

Signed, scannable credentials such as Excelsior Pass and SMART Health Cards solved part of this. A verifier app could confirm in a second that the code was issued by the state and had not been altered. Reporting at the time suggested many venues glanced at the screen rather than scanning it, and paper cards could only be inspected by eye. Verification strength in the field was set by the weakest accepted format and the busiest host stand.

The incentives explain the behavior. Enforcement focused on whether a business had a checking process, not on whether each check was rigorous. A host who challenges a regular risks a scene and a lost customer; a host who waves someone through faces little consequence. Any design that relies on front-line staff doing an unpaid, unwelcome task carefully, every time, should be treated as optimistic.

Who carries the cost of checking

Verification capacity differed sharply by type of venue. Large arenas and theaters could station staff with scanners at controlled entrances and absorb the cost. A small restaurant had a host, a tablet and a queue. Gyms with membership systems could record vaccination status once and stop checking at the door.

Any agency that delegates verification to third parties should expect the same spread. The policy is uniform; the ability to carry it out is not. Simple, fast checks, clear guidance and tolerance for a once-only check where a relationship exists make verification more likely to happen at all.

Anyone buying security technology should take note: the real strength of a credential system is what happens at the point of checking, with real people under real time pressure.

The verifier’s own supply chain

Verifiers need tools, and the tools come from somewhere. New York offered its own free scanner app for Excelsior Pass, and other states and private firms offered apps that could read SMART Health Cards. Some businesses used apps from ticketing or venue management vendors that bundled verification with other features.

Each of those tools is a party that sees the credential. An agency cannot control every app a business downloads, but it can publish a reference specification, provide a free verifier that meets it, and name the behaviors that would breach trust. It can also require its own contractors to meet the specification in writing, with audit rights.

Privacy at the point of checking

Verification also carries a privacy design question. A good verifier shows only what the check requires, here a name and a valid status, and keeps no record. A poor one stores scans, revealing where people have been. Over weeks, a log of scans could become a map of someone’s evenings out. Agencies should specify verifier behavior as carefully as the credential itself, publish what verifiers can and cannot see, and test vendor apps against that specification.

Data minimization goes further than storage. A SMART Health Card verifier could see a name, a date of birth and vaccination details, more than a door check needed. Newer credential standards let a holder reveal a single attribute, such as being over 21, without revealing the birth date behind it. When an agency chooses a format, it is also choosing how much every verifier will learn.

Fallback: the paper card held the program together

Key to NYC accepted the paper CDC card. That choice weakened fraud resistance, and counterfeit cards were a known problem. It also meant that nobody was shut out for lack of a smartphone, a matching registry record or the skills to use an app. Residents who found the digital pass easier used it. Everyone else carried paper.

The fraud cost of paper

The cost was real. In March 2021, the FBI and the HHS Office of Inspector General warned the public that making, buying or using fake vaccination cards bearing a government agency’s seal was a crime. Counterfeits circulated through the spring and summer, and a host had no way to tell a good forgery from the real thing. Accepting paper meant accepting that some share of the people seated indoors had not been vaccinated.

The fallback as load management

The fallback did a second, less visible job. It took load off the digital system. Registry errors did not stop anyone from eating indoors, because a resident with a bad record could still show a card. The resident with the swapped birthday could still go to dinner while she sorted out the correction. Verifier confusion at the door had a simple resolution. Because the app was a convenience and not a gate, its failures became inconveniences rather than exclusions.

The fallback also shaped adoption. Digital passes spread because many people found them easier than carrying a card, not because they were compelled. Chosen adoption is the healthiest kind for a government credential, because it is resilient to the next failure.

It also bought time. A program that launched in two weeks could not have fixed its registries first. Paper let the city start enforcement on schedule while records were corrected, help lines caught up and businesses learned the routine.

Matching the fallback to the stakes

The trade-off is real. Accepting paper lowered assurance, meaning the degree of confidence that a credential is genuine and belongs to the person showing it. An agency must decide how much fraud risk a fallback introduces for its specific use. For a dining requirement, the answer tolerated a lot. For a credential that grants access to money or secure facilities, the fallback might need to be an in-person check rather than a piece of card stock.

The principle holds either way. Plan the non-digital path first, size it for the people the digital path will fail, and remove it only when evidence shows the digital option works for nearly everyone.

Fallbacks for higher stakes

A paper card is only one kind of fallback. For higher-stakes credentials, agencies have several stronger options, each with its own cost:

• In-person verification at a counter. Staff examine original documents. It is strong and inclusive, but it is slow and expensive, and it is hard for people who work during office hours.
• Assisted digital service. A staff member or trusted community partner helps someone through the digital process. It keeps one system but needs trained helpers.
• Delegated access. A caregiver or representative acts on someone’s behalf under recorded authority. It serves people who cannot use a phone, but it needs clear rules to prevent abuse.
• Mailed confirmation. A code sent to an address on file adds assurance at the price of days of delay, and it fails people without a stable address.

The choice should follow from what the credential unlocks and who is most likely to need the fallback. Agencies often discover that those two answers pull in opposite directions, and they have to decide which risk to carry.

The counter-argument: paper made the digital pass pointless

The strongest objection runs like this. If a forgeable card was accepted everywhere a signed pass was, the signed pass added no assurance to the system as a whole. Anyone wanting to cheat would simply use paper. On that view, the state’s investment bought convenience for honest people and nothing against dishonest ones.

The objection is correct about system-wide assurance, and it should make agencies honest about what a fallback costs. It misses two things. First, every person who chose the signed pass was checked to a higher standard, which narrowed the population that fraud could hide in. Second, the digital pass built the issuance and verification machinery that later credentials could reuse. The objection becomes decisive for high-stakes credentials, where a weak fallback really does undo the strong path. That is where the fallback must be strengthened, not removed.

A parks department goes digital with its permits

To see how the three parts play out inside an organization, suppose a county parks department decides to replace its laminated annual parking permits with a digital permit on residents’ phones.

The project team starts, sensibly, with the record rather than the app. Permits are tied to resident accounts in the department’s billing system. A data analyst pulls a sample and finds that a meaningful share of accounts have outdated addresses, duplicate entries for the same household or vehicle details typed in different ways. If the digital permit drew on those records unchanged, a noticeable number of residents would get an error the first time they tried. So the team budgets a clean-up phase and assigns a small group in the permits office to own corrections, with a target turnaround they publish on the website.

Next comes identity. Should a resident get a permit by entering an account number and a ZIP code, or by logging into a verified county account? The first is fast and easy to abuse; the second is safer and will put some people off. Because a parking permit unlocks little of value, the team chooses the lighter option, records why, and agrees to revisit it if fraud appears.

Then verification. Parking attendants will check permits with a handheld scanner. The team writes down what the scanner may show, a valid-or-not result and a vehicle plate, and that it must keep no log of where each car was seen. Before signing the vendor contract, they test the vendor’s app against that list and find it stores scan history by default. The setting is switched off and written into the contract.

The team also tests the permit with residents who will find it hardest: older residents, people using screen readers and people whose first language is not English. They find the activation email is easy to mistake for spam and rewrite it. They add a help line script, so staff answering calls give the same answers.

Finally, the fallback. The laminated permit stays valid for at least a full year, and residents can still get one at the counter. The team sets a simple rule: the paper option will be reviewed only when the digital permit works for nearly everyone who tries it and complaints have leveled off. They agree in advance which numbers will count as evidence: the share of first attempts that succeed, the time to fix a failed record and the number of help calls each week.

When launch day comes, there are glitches, as there always are. A batch of accounts fails to match. Some attendants forget to scan. But because the record clean-up was planned, the correction team exists, the verifier is privacy-safe by design and the laminated permit still works, the glitches stay small. Nobody is turned away from the park.

Notice what the app itself contributed to that outcome: very little. The decisions that mattered were about data, identity, people at the point of checking and the path for those the technology fails.

The same three parts in licenses, benefits and records

Vaccine passes are gone from daily life, but the design problem they posed is everywhere in government and regulated industry. Agencies are moving licenses, permits and benefit cards onto phones. Banks and insurers increasingly accept digital proofs of identity. Hospitals exchange digital records about patients. Each of these faces the same three parts.

How the parts differ by sector

• State motor vehicle agencies. A mobile driver’s license is issued from the licensing record, verified by police, retailers and airport security, and backed by the plastic card. The verifier population is huge and mostly untrained.
• Benefits agencies. Issuance depends on eligibility records that change monthly. The stakes are money, so the fallback must resist fraud as well as include people who lack phones.
• Banks and credit unions. Customer identification rules under anti-money laundering law require them to verify identity when opening accounts. A digital ID can help, but the institution remains responsible for its own verification and for alternatives when it fails.
• Health systems. Patient portals and record exchange depend on matching the right record to the right person. The same matching errors that blocked vaccine passes can attach one patient’s data to another.

Long-lived credentials raise new problems

A vaccine pass recorded a past event and rarely changed. A license or a benefit card is different. It must be renewed, suspended, updated after a move and reissued when a phone is lost or replaced. Each of those events is an issuance event, with the same matching and identity questions as the first one.

Device loss deserves particular planning. When a credential is bound to a phone, the agency needs a fast way to disable the old copy and issue a new one, and the fallback must cover the gap. People lose phones far more often than they lose wallets, and the help line will hear about it.

What is at stake for leaders

The stakes for leaders are concrete:

• Residents and customers. A credential that fails for people with messy records, no smartphone or limited digital skills shuts out exactly the people public services most need to reach. It creates a fairness problem and, often, a legal one.
• Cost. Correction channels, help lines and in-person service carry much of the real cost of a digital credential, yet they are frequently left out of the business case.
• Risk. The assurance level of the whole system is set by its weakest accepted path. Leaders should know what that path is and accept its risk deliberately.
• Trust and reputation. A verifier that silently logs where people go can turn a convenience into a surveillance story overnight.

Building from the back end out

The sturdiest credential programs are designed from the back end out. Before launch, the agency knows how many eligible people have a clean record, and it has a staffed, owned process to fix the rest. The credential is signed to an open standard, so verifiers can check it without special arrangements. Verifier apps are specified to show the minimum and store nothing, and the agency publishes that specification. A non-digital route exists, is sized for the people the digital route will fail, and carries an assurance level suited to what the credential unlocks. Retirement of that route is a decision based on evidence, not a launch-day assumption.

Sequencing matters as much as design. A phased launch, starting with a group whose records are known to be clean, exposes matching and help line problems while volumes are small. Launching to everyone on the day a requirement takes effect, as emergency programs often must, removes that cushion. In that case the fallback carries the load the pilot would otherwise have absorbed, which is one more reason to keep it strong.

Budgets should follow the same logic. The business case for a digital credential usually counts savings at the counter and in printing. It should also count the correction team, the help line, verifier outreach and the fallback itself for as long as it runs. Programs that leave those costs out tend to cut them first when money tightens, which is exactly when residents notice.

The measures to track

A short set of measures tells leaders whether the design is working:

• First-attempt success: the share of people who get a credential on their first try.
• Correction time: how long it takes to fix a record, from request to working credential.
• Fallback use: how many people rely on the non-digital path, and whether that number is falling for good reasons.
• Verification behavior: whether checkers actually scan, based on spot checks rather than assumptions.
• Complaints and help calls: volume and themes, reviewed weekly in the first months.

These measures belong to a program owner, not to the app vendor. A vendor can report on the app; only the agency can see the whole path a resident takes.

Who owns what

Credential programs fail at the seams between teams, so the roles should be named before launch. A program owner answers for the whole resident journey. A data steward owns the quality of the underlying records and the correction rules. An identity lead owns the proofing choice and its review. Someone owns relations with verifiers: guidance, the reference app and complaints. And the help line is staffed and scripted by people who can see all of it.

The vendor contract should reinforce those roles. The agency, not the vendor, should control the signing keys, so that it can change vendors without reissuing every credential. The contract should bar secondary use of any data the vendor sees, require notice of security incidents and include an exit plan. A compromise of the signing key would undermine every credential at once, so the agency needs a written plan for replacing it.

The usual errors

• Treating the app as the product. The registry behind it is where most failures happen.
• “Contact your provider” as a correction process. If the provider has closed or cannot be reached, residents are stranded.
• Accepting a vendor’s identity proofing defaults without deciding whether they match the risk.
• Assuming verifiers will scan. Design for the busy front desk, not the ideal one.
• Going digital-only too early. Removing the fallback before evidence supports it turns every glitch into an exclusion.

Before launch day

• What share of the people eligible for this credential have a record that will match today, and how do we know?
• Who owns corrections, how long do they take, and what happens if the original source of the record no longer exists?
• What exactly does a verifier see and store, have we published that, and have we tested vendor apps against it?
• What is our non-digital path, how many people do we expect to use it, and is it staffed for that?
• What evidence would we need before retiring the non-digital path?

With hindsight

Key to NYC lasted about seven months. In December 2021 the city tightened it, extending the requirement to children aged 5 to 11 and moving older residents from one dose to a full primary series. It lifted the requirement for indoor venues in March 2022 as case rates fell. Vaccine passes faded across the United States. SMART Health Cards remain available from many state immunization systems, a low-key legacy of a loud period.

The design insights have outlasted the program. Mobile driver’s licenses, built on the ISO/IEC 18013-5 standard published in 2021, have spread to a growing number of states. ISO/IEC 18013-5 is the international rulebook for how a license on a phone is issued and checked. It plays the same role for licenses that SMART Health Cards played for vaccination records, and it supports revealing a single attribute, such as age, without the rest of the license.

Airport security became the largest test. Arizona became the first state to put its license in Apple Wallet in 2022. In October 2024, TSA finalized a rule allowing it to keep accepting mobile licenses while federal standards matured. Full REAL ID enforcement began in May 2025. By 2026 TSA accepted digital IDs at more than 250 airports, through phone wallets and state apps. Its guidance still requires every traveler to carry an acceptable physical ID.

That last detail is the Key to NYC pattern again. The plastic card is the fallback, and its continued validity is what allows the digital version to be adopted at people’s own pace, with its early failures causing inconvenience rather than missed flights.

The issuance lesson was also confirmed, in a less comfortable way. In March 2023, the General Services Administration’s inspector general found that GSA had told agency customers its Login.gov service met a federal identity assurance level that it did not meet. Agencies had relied on that claim instead of checking it. The episode showed why an agency should choose its identity proofing level deliberately and verify what a provider delivers. In July 2025, NIST finalized a new revision of its digital identity guidelines, SP 800-63-4, giving agencies an updated framework for those choices.

Europe drew a similar line from pandemic certificate to general credential. In 2023, the World Health Organization took up the EU’s digital COVID certificate system as the basis of a global digital health certification network. The EU’s revised digital identity regulation entered into force in 2024 and requires member states to offer digital identity wallets to citizens by the end of 2026.

Not everything carried over. The idea, common in 2021, that vaccine passes would become a general-purpose health pass for daily life did not survive the end of the mandates. Credentials that lasted were the ones tied to a durable need, such as identity at an airport, rather than to an emergency.

The mobile license programs that have worked best show the same three elements as Key to NYC: an authoritative issuing record, a verifier designed to reveal only what is needed, and a physical alternative that keeps anyone from being shut out while adoption grows.

Agencies planning digital benefit cards or permits face the same three choices. The practical message is to spend at least as much attention on the record behind the credential, the person checking it and the path for people the technology fails as on the app itself. Those are less visible than a polished interface, and they decide whether a digital credential earns trust or loses it. A program that gets them right can afford an app that is merely adequate; one that gets them wrong cannot be rescued by an excellent app.