Answers to common questions about My RBTP Credentials. For step-by-step instructions, see the User Guide. Guides are also available in Japanese, Chinese (Simplified), and Korean.

About My RBTP Credentials

• What can I expect in My RBTP Credentials in the future?

Getting access

• How do I access My RBTP Credentials?
• Can I issue a record for a site that is not in RBA Online?

Issuing Digital Facility Records

• How do I issue a Digital Facility Record (DFR), and what do I need to provide?
• How many DFRs can I create, and can they be unencrypted or encrypted?
• What is stored in a DFR, and how is it kept secure?
• What does "Unassured" mean next to my country-of-origin information?

Sharing

• What do I share, and what value does it give to the recipient?
• Can I search for my suppliers' or other unencrypted records in RBA Online?

Versions and revoking

• Why does the old version of my digital credential still exist?
• What does revoking do?

Credential Library

• Is there a place to store credentials I receive from others?
• What kinds of credentials can I add to the Credential Library?
• How can I still see an encrypted credential I added from an external source, if My RBTP Credentials does not store the key?
• What do "Verified" and "Valid" mean in the library?
• Can I share or update a credential I added from someone else?

Guides in other languages

• Are the user guides available in other languages?

About My RBTP Credentials

What can I expect in My RBTP Credentials in the future?

The current release covers facilities and their assessments. These capabilities are in development and will be added to My RBTP Credentials in future releases:

• Detailed RMAP selections: more control over which parts of an RMAP assessment result to include in a record.
• Product-level records: records for individual products, batches, or shipments, in addition to facilities.
• Multi-tier traceability: records that link across several levels of the supply chain.

Getting access

How do I access My RBTP Credentials?

Open RBA Online, go to Supply Chain > My RBTP Credentials and click the link to the portal, or go directly to dfr.credentials.responsiblebusiness.org. Sign in with the email address registered in RBA Online and enter the one-time passcode sent to you to confirm it is you. If your company is not yet in RBA Online, see the Starter Guide for New RBA Online Users (PDF).

Can I issue a record for a site that is not in RBA Online?

Yes. Organizations whose sites are not in RBA Online, including companies that are not RBA members, can register and issue Digital Facility Records. Start with the RBTP Facility Registration form, then follow the Starter Guide for New RBA Online Users (PDF) for the full walkthrough.

Issuing Digital Facility Records

How do I issue a Digital Facility Record (DFR), and what do I need to provide?

On your facilities list, click Issue New Digital Facility Record. Most details are filled in from RBA Online. You add a record name and can optionally add country-of-origin claims, VAP or RMAP assessment results, and external credentials from your Credential Library, then issue it as unencrypted or encrypted. See Issuing a Digital Facility Record in the User Guide.

How many DFRs can I create, and can they be unencrypted or encrypted?

Each facility can have one current unencrypted (public) record and one current encrypted record at a time. To change either one, use Issue New Version rather than creating a new record. Each new version gets a new version number and becomes the current record.

Earlier versions aren't deleted. They are kept in your Credential Library, where you can see every version on the record's Versions tab, and anyone who opens a link to an older version is pointed to your newest version.

What is stored in a DFR, and how is it kept secure?

A record holds your facility's business details from RBA Online, any country-of-origin claims you add, any VAP or RMAP assessment results you include, and any external credentials you attach. Unencrypted records open with the link alone. Encrypted records generate a URL that contains the encryption key, so only share them with trusted parties.

What does "Unassured" mean next to my country-of-origin information?

On the rendered DFR, "Unassured" appears next to country-of-origin information that you have self-declared for your facility. In future updates to the tool, users will have the option to attach the portion of an RMAP report that provides the countries of origin validated during the assessment ("Assured"), if the facility has completed an RMAP assessment, or to provide links to other assessments that support country-of-origin claims.

Sharing

What do I share, and what value does it give to the recipient?

You choose which version to share. An unencrypted record opens with the link alone, so anyone who receives it can view it. An encrypted record opens only with both the link and its access key, letting you include more sensitive details and share them with trusted parties. Either way, recipients get verified facility and compliance information in a standard format that supports their own due diligence and reporting.

Can I search for my suppliers' or other unencrypted records in RBA Online?

No. Today you must request links for unencrypted records from suppliers and others in your supply chain. Options to more easily search for, or prompt suppliers for, unencrypted records are being reviewed for a future update.

Versions and revoking

Why does the old version of my digital credential still exist?

When you issue a new version of a credential (for example, a Digital Facility Record), the previous version is not deleted. Every version is a fixed record that cannot be edited. It is kept as part of the credential's version history, so there is always a record of what the credential said and when it changed. You can see every version on the Versions tab.

Anyone you have already shared the old link with, such as a customer or an auditor, can still open it, and they will be redirected to your newest version.

A new version means the details have changed, but the earlier version was accurate when it was issued. If a record should no longer be relied on at all, use Revoke instead.

What does revoking do?

Revoking marks a credential as no longer valid, but the record itself is not deleted. It is permanent and cannot be undone. Anyone who already has its link can still open it, but they will see that it has been revoked.

Revoke a credential when the information in it should no longer be relied on at all. For example:

• You issued the record for the wrong facility.
• A facility has closed permanently or is no longer part of your organization, and the record should not be used to describe it anymore.
• You have found important incorrect data in the record, and you do not want anyone relying on it while you address it.

If the details of a facility have simply changed, such as a new address or an updated country-of-origin claim, issue a new version instead. This creates a new version of the Digital Facility Record and points people to the most current information.

Because revoking cannot be reversed, you will be asked to type the credential's name to confirm before it goes ahead.

Revoke is only available on credentials your own organization issued. You cannot revoke conformity credentials issued by the RBA, such as the RMAP or VAP Digital Conformity Credentials.

Credential Library

Is there a place to store credentials I receive from others?

Yes. Use the Credential Library to add credentials you receive by pasting their link. Each one is verified and a copy is kept for you. See Adding an external credential in the User Guide.

What kinds of credentials can I add to the Credential Library?

Credentials hosted at a public https:// link that are a DFR (Digital Facility Record), DCC (Digital Conformity Credential), DPP (Digital Product Passport), DTE (Digital Traceability Event), or DIA (Digital Identity Anchor). Each one is retrieved, verified, and kept as a copy in your library.

How can I still see an encrypted credential I added from an external source, if My RBTP Credentials does not store the key?

You can still see it because My RBTP Credentials keeps its own copy of the credential, locked with a key that the tool creates, rather than the key from the external source.

When you add an encrypted credential from an external source:

1. You enter the link and the decryption key that the external source sent you.
2. My RBTP Credentials uses that key once: to open the credential, check that it is genuine, and save a copy of the credential to your library.
3. My RBTP Credentials creates a new key to lock that saved copy. The external source's key is not stored.

That is why you can open the credential in your library later without entering the key again: you are viewing the saved copy, locked with the new key. A full re-verification against the original requires the external source's key again.

This applies only to credentials you add from an external source. For credentials that your organization issues through My RBTP Credentials, and credentials that the RBA issues on your behalf, the RBA creates the encryption key and stores it. That is why you can open those credentials and share them along with their access key.

What do "Verified" and "Valid" mean in the library?

Verified means the credential is authentic, untampered with, and not revoked by the party that issued it. It is not an endorsement of the issuer. Validity reflects the credential's validity dates only; it is not a compliance result.

Can I share or update a credential I added from someone else?

No. External credentials can't be shared from My RBTP Credentials, and only the issuing organization can issue a new version of a credential or revoke it. You can remove external credentials from your library at any time.

Guides in other languages

Are the user guides available in other languages?

Yes. The Full User Guide and both starter guides are available in English, Japanese, Chinese (Simplified), and Korean.

The English guides are updated first. If a translated guide differs from the English version, follow the English version.

Still have a question?

Contact the RBTP Help Desk at rbtphelpdesk@responsiblebusiness.org.