National Academic Credentials Registry

Outcomes

Context

National-scale trust problem: documents must be authentic, processes must be attributable, public verify must stay narrow.

Challenge

Academic credentials needed a trustworthy digital lifecycle: institutions enter and approve records, ministries oversee, graduates receive verifiable documents, and third parties need a public verify path without exposing the full registry.

Approach

We engineered a Next.js management surface and API workflows, Keycloak for roles, TYPO3 for public content, PostgreSQL as system of record, MinIO for document objects, and Puppeteer-based PDF generation with QR verification artifacts. Traefik routed the multi-service stack.

Architecture

Next.js 15 apps in an npm workspace, Keycloak IdP, TYPO3 14 public site, PostgreSQL 17, MinIO, Puppeteer PDF workers, Traefik edge.

Scope

• —Student and grade registry
• —Diploma and transcript publishing
• —PDF + QR generation
• —Public verify experience
• —Institution and ministry administration
• —Identity and role control

Constraints

• —High sensitivity of academic personal data
• —Multiple institutional actors
• —Need for offline-verifiable document artifacts (QR)
• —Public site separate from management API

Solution highlights

• —Keycloak-backed role model
• —Object storage for generated documents
• —Puppeteer pipeline for consistent PDF output
• —Public verify surface intentionally minimal

Technologies

Results

• —End-to-end path from institutional entry to published verifiable diploma
• —Role-separated admin for ministry and institutions
• —Public verification widget without opening the private registry
• —Audit-tracked delivery with the majority of requested change items closed in phase one

Lessons learned

• —Public verify UX must be boring and narrow — that is a feature.
• —Identity roles are the real architecture in government registries.
• —PDF generation belongs in workers, not request threads.