---
title: "Credentials the brand holds"
url: https://services.dev/docs/people/brand-credentials
captured: [brand-credential.txt, gate-brand-credential-missing.txt]
codes: [brand_unverified]
---
# Credentials the brand holds

URL: https://services.dev/docs/people/brand-credentials

> Some acts are performed under a credential the brand itself holds, such as an e-file number. Declare it in Brand(), name it in a rules row, and an act that needs it waits while it is unverified or stale.

Not every credential is a person's. A brand that files with a government office may file under its own registration, and the rules can reserve an act to it, so no person needs to hold it and the AI still does the work. The brand holds the credential, a verifier keeps it fresh, and the gate checks it before the act.

## Declare it, then reserve to it

`Brand({ credentials })` names each credential the brand holds, with the verifier that checks it:

```bash
cat brand.ts
```

```txt title="magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
import { Brand } from 'services.dev'

// A filing brand that e-files under its own e-file number: a credential the brand itself holds,
// verified by its own verifier and kept fresh. On a test key the sandbox stands in for the verifier.
export default Brand({
  domain: 'filings.example',
  credentials: { efin: { verify: 'https://verify.example.test/efin', fresh: '30d', via: 'the e-file application' } },
})
```

A rules row reserves the act to it with `{ reserved: { brand } }`:

```bash
cat rules.ts
```

```txt title="magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
import { Rules } from 'services.dev'

// The brand's counsel reserves the e-filing to the brand's own credential, not a person's.
export default Rules({
  version: '2026-10',
  services: {
    extension: { file: { reserved: { brand: 'efin' }, where: '*', position: "An extension is e-filed under the brand's own e-file number." } },
  },
})
```

`check` reads both:

```bash
npx services.dev check
```

```txt title="magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
brand.ts · 2 lines · filings · filings.example · holds efin
  who     AI delivers every job. (rules 2026-10)
  bounds  reserved file to the brand's efin
```

A row can also need both a person's credential and the brand's: `{ reserved: 'sworn translator', and: { brand: 'registry account' } }`. A row that names a brand credential `brand.ts` doesn't declare fails [`brand_credential_missing`](https://services.dev/docs/reference/check/brand_credential_missing.md):

```bash
npx services.dev check
```

```txt title="magic values: none"
brand.ts · 2 lines · lingua · lingua.example · holds registry account
  bounds  reserved sign to sworn translator, under the brand's registry account
```

## While it is stale

An order whose act needs a credential that isn't verified and fresh answers 403 `brand_unverified`, charges nothing, and names the waitlist. On a test key the sandbox stands in for the verifier, so each branch runs without one:

**Verified**

```txt
→ POST /jobs {"service":"extension","year":2025,"max_usd":25,"key":"verified","metadata":{"sandbox":{"brand":"verified"}}}
```

```txt title="magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
← job_7Hq2 · delivered · form.txt · $25.00 charged
  record  form · ai | review · ai · pass | file · the IRS · efin verified · accepted · rcp_7Hq2
```

**Stale**

```txt
→ POST /jobs {"service":"extension","year":2025,"max_usd":25,"key":"stale","metadata":{"sandbox":{"brand":"stale"}}}
```

```json title="403 · magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
{
  "type": "BLOCKED",
  "category": "unavailable",
  "code": "brand_unverified",
  "reason": "file is performed under the brand's efin, which isn't verified and fresh.",
  "act": "file",
  "credentials": [
    "efin"
  ],
  "rule": {
    "version": "2026-10",
    "at": "services['extension'].file",
    "position": "An extension is e-filed under the brand's own e-file number."
  },
  "next": {
    "do": "waitlist",
    "service": "extension",
    "arguments": {
      "email": null
    },
    "tool": null,
    "http": "POST http://localhost:8787/extension/waitlist",
    "url": "http://localhost:8787/extension"
  },
  "doc_url": "https://filings.example/docs/errors/brand_unverified",
  "request_id": "req_m8cwgn",
  "simulated": true
}
```

**Test key**

```txt
→ POST /jobs {"service":"extension","year":2025,"max_usd":25,"key":"a test key, neither"}
```

```txt title="magic values: metadata.sandbox.brand = verified, metadata.sandbox.brand = stale"
← job_7Hq3 · delivered · form.txt · $25.00 charged
  record  form · ai | review · ai · pass | file · the IRS · efin simulated · accepted · rcp_7Hq3
```

The record names the credential on the act it covered, `efin verified`, or `efin simulated` on a test key.

## Every form

| Key | What it says | Default |
|---|---|---|
| `credentials.<name>.verify` | The verifier: a URL or your function. The only writer of the credential's facts | required |
| `credentials.<name>.fresh` | How old a verification may be before the act waits, such as `'30d'` | — |
| `credentials.<name>.via` | Where it comes from, such as the application that issued it | none |
| `{ reserved: { brand } }` | A row reserved to the brand's credential | — |
| `and: { brand }` | A brand credential a row needs beside a person's | none |

## Refusals

| Code | When |
|---|---|
| [`brand_unverified`](https://services.dev/docs/reference/errors.md#brand_unverified) | The act's brand credential is unverified or stale. Nothing is charged |
| [`brand_credential_missing`](https://services.dev/docs/reference/check/brand_credential_missing.md) | `check`: a row names a credential `brand.ts` doesn't declare |

---

- Up: [human: the line](https://services.dev/docs/people.md)
- Previous: [When the client does it themselves](https://services.dev/docs/people/self.md)
- Next: [What a person can do](https://services.dev/docs/people/acts.md)