1. What Is gs1:jws?
gs1:jws is a dedicated link type within the GS1 Digital Link framework specifically designed to request a JSON Web Signature for a product. According to the GS1 official guidelines, gs1:jws is a specialised link type that can be used to request a redirection to an online JSON Web Signature [JWS], provided that the GTIN licensee (typically the brand owner) has made such a signature available for that product instance.
To understand gs1:jws, we first need to grasp two core concepts:
What Is JSON Web Signature (JWS)?
JSON Web Signature (JWS) is an open standard defined by RFC 7515. It uses JSON (JavaScript Object Notation) as a data interchange format – a text syntax that facilitates structured data exchange across all programming languages. Simply put, JWS is a standardised format for digital signatures – it combines data (the payload) with a digital signature to form a complete, verifiable signed object.
A JWS consists of three parts:
- Header – metadata describing the signing algorithm, etc.
- Payload – the actual data content being signed
- Signature – the cryptographic signature generated over the Header and Payload
GS1 Digital Signature Application Standard
The GS1 Digital Signature Application Standard was approved in 2023 and is published in the GS1 General Specifications. It is an open standard solution that supports independent verification of digitally signed data by leveraging ISO/IEC 20248, JSON Web Signatures (JWS), or XML Digital Signatures.
gs1:jws is the standard entry point within the GS1 Digital Link ecosystem for obtaining a JWS.
Differentiation from Other Link Types
Within the GS1 link type system, gs1:jws is fundamentally different from common “content‑oriented” link types:
| Link Type | Function | Returned Content |
|---|---|---|
gs1:pip (Product Information Page) | Provide product information | HTML page (human‑readable) |
gs1:instructions (Instructions) | Provide usage instructions | HTML page (human‑readable) |
gs1:certificationInfo (Certification Info) | Provide certification information | HTML page (human‑readable) |
gs1:jws (JSON Web Signature) | Provide a digital signature | JWS object (machine‑readable, for verification) |
What makes gs1:jws unique is that it is not designed for “human reading” but for “machine verification”. It returns a structured, cryptographically verifiable JWS object, not a pretty web page.
2. Core Value of gs1:jws
2.1 A “Digital Fingerprint” for Product Authentication
In a world where counterfeit products are rampant, both brands and consumers face one critical question: “How do I know this is genuine?”
gs1:jws provides a technological answer to this question. Brands can generate a unique digital signature for each product (achieving item‑level identification through GTIN + serial number) and store that signature as a JWS in the cloud. When a consumer or authentication app requests the signature via linkType=gs1:jws, the system returns the JWS, and the app can verify the integrity and authenticity of the product data by validating the signature.
This creates an immutable “digital fingerprint” for each product – any tampering with the product data will cause the signature verification to fail.
2.2 Enabling Independent, Open Authentication
A core design principle of the GS1 Digital Signature Application Standard is support for independent verification. This means:
- Any consumer can independently verify using a smartphone app, without relying on the brand’s proprietary system
- Digital signatures from different signers must be independently verifiable
- Open, free, and interoperable verification – not locked into a specific platform or technology stack
gs1:jws is the standardised entry point for implementing this open verification architecture. It transforms GS1 Digital Link from merely an “information query” tool into a “trust verification” gateway.
2.3 Building a “Verifiable Digital Twin” for Physical Products
Traditional anti‑counterfeiting measures – holograms, scratch‑off codes, laser labels – often rely on “visual inspection” or “phone query” and lack technical rigour and verifiability.
Through gs1:jws, brands can create a verifiable digital twin for each product:
- Product data (GTIN, serial number, batch number, etc.) is digitally signed
- The signature is stored alongside the product data in the cloud
- Consumers or authentication apps scan the code and verify the signature to confirm the authenticity of the product data
- The verification result is independent, objective, and reproducible
This model of “physical product + digital signature” significantly raises the bar for counterfeiters.
2.4 Supporting Multiple Authentication Workflows with High Flexibility
The GS1 Digital Signature Standard supports three different authentication workflows:
| Workflow | Characteristics | Use Cases |
|---|---|---|
| Workflow 1 | Payload contains only basic product information, no security markers | Basic product data authenticity verification |
| Workflow 2 | Payload includes expected values of physical security markers; App guides user to compare | Scenarios requiring the user to “look at” a security marker |
| Workflow 3 | Payload does not contain the security marker value; user must manually enter the code from the security marker | Highest security level, enforcing physical inspection |
gs1:jws flexibly supports all three workflows, allowing brands to choose the most suitable solution based on product type, security needs, and cost considerations.
2.5 Enhancing Consumer Trust and Reducing Brand Risk
For brands, counterfeit products not only cause direct financial losses but, more importantly, damage brand reputation and consumer trust. Through product authentication enabled by gs1:jws:
- Consumers can easily verify – no specialised knowledge required; a smartphone app does the job
- Verification results are trustworthy – based on international standard digital signature technology, not a proprietary black box
- Brands can proactively fight counterfeiting – building a defence before problems arise, rather than reacting after the fact
3. Typical Application Scenarios
Scenario 1: Luxury Goods and High‑Value Products – Item‑Level Authentication
A luxury brand uses GS1 Digital Link QR codes containing unique serial numbers (GTIN + serial number) on every product. The brand generates a JWS for each product, stores it in the cloud, and makes it accessible via the gs1:jws link type.
When a consumer purchases the product:
- They scan the GS1 QR code on the product using a smartphone app
- The app automatically requests
linkType=gs1:jwsto obtain the product’s JWS - The app verifies the signature’s validity
- Verification passes → the product is genuine; verification fails → potential counterfeit risk
Every product has a unique, non‑replicable “digital identity card”.
Scenario 2: Pharmaceuticals and Medical Devices – Regulatory Compliance and Patient Safety
In the pharmaceutical industry, counterfeit drugs directly threaten patient lives. Through gs1:jws:
- Pharmaceutical companies generate digital signatures for each batch or each individual drug pack
- Hospital pharmacies verify the signature upon drug receipt, confirming the authenticity of the drug source
- Patients can also scan the code with their smartphones before taking the medication, ensuring they receive genuine drugs
- Regulators can independently verify, without relying on the brand’s proprietary systems
This aligns perfectly with the GS1 Digital Signature Standard’s principle of “supporting independent verification.”
Scenario 3: Electronics – Supply Chain Diversion Prevention and Warranty Verification
A consumer electronics brand sells products in multiple global markets. Through gs1:jws:
- Each device is assigned a unique digital signature at the time of manufacture
- The signature can include the product’s intended sales region information
- When channel partners scan and verify, the system can identify whether the product has been diverted across regions
- When consumers apply for warranty service, they verify the signature to confirm the product is genuine and within warranty
Digital signatures are used not only for anti‑counterfeiting but also for supply chain compliance management.
Scenario 4: Workflow 3 – Highest Security with Physical + Digital Dual Verification
For high‑value, high‑risk products (e.g., luxury watches, precious artwork, important documents), brands can opt for Workflow 3 security mode:
- The product carries a physical security marker (e.g., scratch‑off authentication code, hidden code on a hologram)
- The brand’s generated JWS does not contain the security marker’s code value
- After scanning, the app prompts the user to inspect the physical security marker on the product and manually enter the code
- The app “plugs” the entered code back into the data and then attempts to verify the digital signature
This model requires the user to physically access the product and inspect the security marker, massively increasing the difficulty of counterfeiting – it is the highest‑level product authentication solution available.
4. Complete Usage Example
4.1 Requesting a JWS via GS1 Digital Link
When a product supporting GS1 digital signatures is scanned, an authentication app can request the JWS by specifying linkType=gs1:jws as a query parameter in the GS1 Digital Link URI.
Basic GS1 Digital Link URI (obtained from the QR code):
https://id.gs1.org/01/06933960552835/21/1234ABDEURI for requesting the JWS (automatically constructed by the app):
https://id.gs1.org/01/06933960552835/21/1234ABDE?linkType=gs1:jws4.2 Resolver Configuration Example
Below is a JSON example of how a brand configures gs1:jws link data in a GS1‑compliant resolver:
{
"anchor": "/01/06933960552835/21/1234ABDE",
"itemDescription": "CloudBrew Craft Beer – Limited Edition IPA (Serial #1234ABDE)",
"defaultLinktype": "gs1:pip",
"links": [
{
"linktype": "gs1:pip",
"href": "https://www.example.com/product/12345",
"title": "Product Details",
"type": "text/html",
"hreflang": ["zh-CN"],
"context": ["general"]
},
{
"linktype": "gs1:jws",
"href": "https://signatures.example.com/jws/01/06933960552835/21/1234ABDE",
"title": "JSON Web Signature – Product Authentication",
"type": "application/jose",
"hreflang": ["zh-CN"],
"context": ["authentication", "verification"]
}
]
}4.3 Field Descriptions
| Field | Meaning |
|---|---|
anchor | The resolver’s routing anchor. 01/ is followed by the GTIN, and 21/ is followed by the serial number, enabling item‑level precise identification. |
defaultLinktype | The default fallback link type. When a normal consumer scans, this is where they are redirected (usually a product details page). |
linktype | The link type – here gs1:jws, indicating a JSON Web Signature link. |
href | The URL to access the JWS, returning the JSON Web Signature for that product instance. |
type | Content type. The MIME type for JWS is application/jose. |
hreflang | Language adaptation (JWS itself is language‑agnostic, but can be used for descriptive metadata). |
context | Context tags to identify the purpose of the link (e.g., “authentication”). |
4.4 Example JWS Response (Illustrative)
When an app requests gs1:jws, the resolver returns a JWS similar to the following (illustrative JSON structure):
{
"payload": "eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiIwMTowNjky...",
"signatures": [
{
"protected": "eyJhbGciOiJFUzI1NiJ9",
"signature": "MEUCIQDL...JZk3Q"
}
]
}In practice, the app will parse and verify the signature according to the JWS specification (RFC 7515).
4.5 User Authentication Workflow (Workflow 1)
- Scan – The consumer scans the GS1 QR code on the product using an authentication app that supports GS1 digital signatures
- Request JWS – The app automatically appends
?linkType=gs1:jwsto the URI and requests the JWS from the resolver - Obtain Signature – The resolver returns the JSON Web Signature for that product instance
- Verify Signature – The app validates the JWS signature according to RFC 7515
- Display Result – The app shows the consumer either “✅ Verification passed – product is genuine” or “❌ Verification failed – potential risk”
4.6 Advantages of This Approach
- Fixed QR code – the code contains only the base path (e.g.,
/01/06933960552835/21/1234ABDE); the JWS is provided on‑demand from the cloud - On‑demand delivery – normal consumers see the product details page (
gs1:pip), while authentication apps retrieve the JWS (gs1:jws) – one code, two purposes - Open standard – based on IETF RFC 7515 (JWS), independent of any proprietary technology
- Independent verification – anyone can verify the signature using open‑source tools, without needing the brand’s proprietary system
- Flexible security levels – supports three workflows, from basic authentication to “physical + digital” dual verification
- Item‑level anti‑counterfeiting – through GTIN + serial number, achieving “one item, one code, one signature”
Summary
gs1:jws is a strategically valuable link type within the GS1 Digital Link ecosystem. With its role as a dedicated link for requesting a JSON Web Signature, it provides the key technical foundation for evolving GS1 Digital Link from an “information query tool” into a “trust verification infrastructure”.
While product details pages answer “what is this product” and instructions answer “how to use it,” gs1:jws answers a more fundamental question: “How do I know this is genuine?”
It connects every product in the physical world to a verifiable digital signature in the digital world. Whether it’s a luxury brand implementing item‑level authentication, a pharmaceutical company ensuring patient safety, an electronics brand managing supply chain compliance, or a high‑value product adopting “physical + digital” dual verification, gs1:jws offers brands a standardised, open, and independently verifiable approach to product authentication and trust building – turning every scan into a confirmation of authenticity.
