Skip to content
Tamga Network
Open trust network · Tamga ARF 1.0

A shared trust network for the Turkic world.

Proving that a document is real shouldn't take phone calls, apostilles and weeks. Tamga Network is a set of shared rules and signed lists that lets digital credentials from any institution be verified across borders, in seconds, while protecting the person's privacy.

List of lists · LOTLtrust.tamga.network
  • TRTürkiye listLive · provisional operator
  • AZAzerbaijan listSeat reserved
  • KZKazakhstan listSeat reserved
  • KGKyrgyzstan listSeat reserved
  • UZUzbekistan listSeat reserved
  • TMTurkmenistan listSeat reserved
  • EUEU lists (federation)Read as external lists

Every state publishes its own list. Today Tamga runs the Türkiye list provisionally, on behalf of the state.

Partners

Organisations we work with

Open standards

The standards we build on

  • OpenID FoundationOpenID4VCI · OpenID4VP · HAIP
  • IETFSD-JWT VC · Token Status List
  • ISO/IEC18013-5 mdoc
  • ETSITrust lists · TS 119 612
  • W3CWebAuthn · passkeys
  • eIDAS 2.0EUDI ARF
Why Tamga Network?

Documents are digital. Trust is still on paper.

Schools, hospitals, chambers and companies issue documents every day. Yet proving that a document is real in another country, or even another institution, is still hard.

  1. 01

    Documents get stuck at borders

    When an institution in Almaty wants to verify a document issued in Baku, it takes phone calls, emails, apostilles and weeks.

  2. 02

    Forgery is easy

    A scanned PDF or a photocopy is easy to alter; telling the real one from a fake takes expertise.

  3. 03

    People share too much

    To prove your age you show your whole ID; to prove you graduated you show your whole transcript.

  4. 04

    Every country has its own system

    Each country builds its own digital system; they don't recognise each other or speak the same language.

  5. 05

    Europe moves ahead; the Turkic world could be left out

    The EU requires every member state to offer its citizens a digital identity wallet by the end of 2026. Without a shared trust structure, Turkic-world credentials stay outside that order.

  6. Our purpose

    That a credential issued by any institution in the Turkic world is accepted with the same confidence in another country. We do it with a shared network that no single company or state owns, run by open rules. Credentials stay on the person's phone; the person shows only what is needed; the verifier is sure in seconds, without asking the source.

Our philosophy

Five principles.

01

The person at the centre

The credential stays in the person's wallet. The person decides what to show.

02

Owned by no one

The network sells no services and gives no one privileges. The goal: an independent foundation.

03

The list belongs to the state

Every state owns its trust list and decides whom it recognises.

04

No personal data on the network

No personal data in lists, records or logs; not even a hash of it.

05

Open rules, open code

Every rule is numbered and public; every package is open source.

How it works

Three parties, one trust list.

The institution that issues, the person who carries, and the party that checks. All three look at the same signed list; nobody has to phone anybody.

Step 1 / 5

The institution prepares the credential

Every field is sealed on its own (salted hash); then the institution signs the whole credential with its key.

Technology, in plain words

Five ideas behind it.

Tamga Network is not a new invention; it brings together tested techniques from Europe's digital identity framework for the Turkic world.

01

Verifiable credential

A document digitally signed by the institution (a credential). Change a single letter and the signature breaks.

Why the Turkic world needs it
Documents issued in different languages and systems are read in the same format and verified the same way.
Problem it solves
Forgery, and weeks of correspondence.
Verifiable credentialA digital credential card with the institution's signature and seal.EXAMPLE UNIVERSITYGraduation credentialnameAyşe YılmazprogrammeComputer Eng.year2026institution signaturesignature: ES256 · institution certificate
02

Selective disclosure

Each field of the credential is locked separately. The person opens only the field that is asked for; the rest stay closed.

Why the Turkic world needs it
An exam centre, a bank and a concert gate ask for different things from the same credential; none of them needs everything.
Problem it solves
Sharing more personal data than necessary.
Selective disclosureFour fields of a credential, each with its own digest; only the over-18 fact is revealed, the birth date stays hidden.fields in the credentialover 18#a3f9…18+: yesbirth date#7c21…hiddenfull name#e04b…hiddendocument no#19d6…hiddenwhat the verifier sees
03

Zero-knowledge proof

Proving that something is true without showing the thing itself. For example, that you are over 18 without showing your birth date.

Why the Turkic world needs it
Questions about age, membership or authority can be answered without opening all of a person's data.
Problem it solves
Showing a whole ID for a yes-or-no question.
Zero-knowledge proofThe birth date goes into the proof; the only output is being over 18; the birth date never reaches the verifier.on the phoneBirth dateZKproofOver18the birth date never reaches the verifier
04

A pseudonym per site

"Sign in with Tamga" gives every site a different identifier for you (a pseudonym). The site recognises you but cannot match you with other sites.

Why the Turkic world needs it
Which sites a person uses cannot be linked, even if the sites share data.
Problem it solves
Cross-site tracking and profiling.
A pseudonym per siteOne person, three sites, three different identifiers; the sites cannot link them.Youticket sitek7f2…9alibraryp91a…3cexam portalz3c8…e1sites cannot match each other
05

Chain of trust

That an institution really is that institution is read from a list signed by the state. The lists in turn are linked to a list of lists.

Why the Turkic world needs it
Every state stays the owner of its list; because the lists share one format, they recognise each other.
Problem it solves
Answering "does this institution really exist?" separately in every country.
Chain of trustThe list of lists signs the national list, the national list the institution certificate, the institution the credential.List of listsLOTL · trust.tamga.networksignsTürkiye listsigned by the statesignsInstitution certificateX.509 · registered institutionsignsCredentialsigned by the institution
Try it yourself

Trust, as open as a signature.

The list is re-signed on every change and chained to the previous one by hash; the public anchor log gets a new line every hour. No one can change it silently; anyone can verify it.

How it works
lotl.jws · sampleNot verified
scheme
Tamga LOTL
version
[version]
issued_at
[issue time]
next_update
[within 90 days]
operator
Tamga · provisional, on_behalf_of: TR
previous_hash
sha256:[digest of previous version]
alg · x5c
ES256 · root certificate chain
Layers of the network

From rules to wallets, six layers.

Open Tamga ARF
  1. 01

    Rules

    Tamga ARF, the Trust Framework, the Tamga Rulebook and the credential-type rulebooks.

    In force
  2. 02

    Trust lists

    Signed, versioned national lists and the list of lists that points to them.

    In force
  3. 03

    Credential formats

    SD-JWT VC and ISO mdoc; issuance with OpenID4VCI, presentation with OpenID4VP.

    In force
  4. 04

    Open packages

    Verification, issuance and wallet core; anyone can run them on their own server.

    Pre-release
  5. 05

    On top of the network

    Wallets and service providers that follow the network's rules. The first wallet is Tamga Wallet.

    On top
  6. 06

    Shared ledger

    Once at least two independent operators join, the same records move to a permissioned ledger.

    Later
Governance

A provisional operator today. A foundation tomorrow.

Tamga runs the network today, but the network is not Tamga's. The path is written down from the start: as states join, governance becomes shared; with two independent operators, the records move to a shared ledger.

Governance rolesThe network's rules sit in the middle; the operator, the registrar and the state lists work by those rules.Network rulesTamga ARFOperatorRegistrarState lists
  1. Today

    Provisional operator

    Tamga publishes the Türkiye list on behalf of the state, with open rules and a public anchor log.

  2. When states join

    Council or foundation

    Lists are handed to their owners; the network's rules change by joint decision.

  3. Two independent operators

    Shared ledger

    Records move to a permissioned ledger; no single party can change them alone.

Developers

Two packages, five minutes.

Verify a credential on your own server. With the hosted verifier you don't even need server code.

terminal
npm install @tamga-network/verifier @tamga-network/trust

The packages are published on npm as the 0.6.0 test release; the stable 1.0.0 comes when everything is ready. In test releases the API may change.

verify.ts
import { fetchListTrustSource, verifyJws } from "@tamga-network/trust";
import { createPresentationRequest, dcqlFromPolicy } from "@tamga-network/verifier";

// 1. Load the trust lists (root fingerprint: tamga.network/trust-anchor)
const { source: trust } = await fetchListTrustSource("https://trust.tamga.network", http, {
  rootFingerprints: [ROOT_FINGERPRINT],
  verifyJws,
});

// 2. Create a signed request, show it as a QR code
const req = await createPresentationRequest({
  signer,
  dcql: dcqlFromPolicy(AGE_OVER_18_POLICY),
  responseUri,
  requestUriBase,
});
show(req.qrPayload);
EU compatibility

The Turkic-world counterpart of what the EU built.

European UnionTamga NetworkWhat it means
eIDAS 2.0 and implementing actsTrust FrameworkWho joins, who supervises, how it is handed over.
EU ARFTamga ARF 1.0Roles, architecture, trust model.
High-level requirementsTamga RulebookNumbered, binding rules for every role.
Attestation rulebooksEducation · Identity · Event TicketEach credential type's own rules.
Trusted lists (LOTL)Tamga LOTL and national listsSame format; EU lists are read as external lists.