Stencil Documentation
Search…
Using Stencil
Guides
Generate certificate of accomplishment
Case study
Often time, course participants will receive their certificate of accomplishment digitally and they can link the image of the certificate in their social profile network like LinkedIn.
If you are running these courses and would like to provide such certificate there are few things that you need to handle.
First, generating the certificate image itself. Then, most importantly ensuring certificate authenticity. Since the image can be doctored digitally, you need to employ your own system to handle certificate validation.
Stencil's secured signed image can solve these issues and you'll see how we can this is handled. Of course, in some complicated cases you would still need to roll your own system but for the majority of the time, this is sufficient.
Guides
Design your certificate template
AWS-like certificate
For this design, candidate's name can be customized later using our API.
Creating Signed URL for Image
Getting the necessary information
You'll need some information that can be retrieved from Console > Integrations > Secure Signed Image
Information required in the next step
Generate the URL
The section Basic explains how the URL is generated. We can use the Python code provided and modifying it based on the information we get. We also need to specify the proper modifications that will be sent to our API.
For example this is the Python code we use with the certificate template that was created from previous step.
Python
1
import json
2
import hmac
3
import hashlib
4
import base64
5
​
6
def base64_encode(string):
7
"""
8
Removes any `=` used as padding from the encoded string.
9
"""
10
encoded = base64.b64encode(string.encode())
11
encoded = encoded.rstrip(b'=')
12
return encoded
13
​
14
def generate_url():
15
user_id = "be6a052e-bce8-4c14-8bbb-ea6b6f9941d5"
16
secret_key = "secretzzzz"
17
base_id = "TEafv3AfNptmzii4zj2jkc"
18
​
19
modifications = [
20
{ "name": "text_candidate", "text": "John Wick" }
21
]
22
​
23
# ensure no spaces in json output
24
encoded = json.dumps(modifications, separators=(',', ':'))
25
encoded = base64_encode(encoded).decode()
26
​
27
parameters = "{user_id}+{base_id}+{modifications}".format(user_id=user_id, base_id=base_id, modifications=encoded)
28
​
29
signature = hmac.new(secret_key.encode(), parameters.encode(), hashlib.sha256).hexdigest()
30
​
31
url = "https://images.usestencil.com/signed-images/{user_id}/{base_id}.png?modifications={modifications}&s={signature}".format(
32
base_id=base_id,
33
user_id=user_id,
34
modifications=encoded,
35
signature=signature
36
)
37
print(url)
38
​
39
if __name__ == "__main__":
40
generate_url()
Copied!
Running the above code gives us the following output,
1
https://images.usestencil.com/signed-images/be6a052e-bce8-4c14-8bbb-ea6b6f9941d5/TEafv3AfNptmzii4zj2jkc.png?modifications=W3sibmFtZSI6InRleHRfY2FuZGlkYXRlIiwidGV4dCI6IkpvaG4gV2ljayJ9XQ&s=f69736c6f17cea118a45dc018103694cbde78d89513de977c2fa1c55faf697df
Copied!
Result
Visiting the URL gives us the certificate,
Signed image with candidate's name
Determining authenticity
All certificates generated and hot-linked using our CDN can be considered as authentic i.e. all links started with
https://images.usestencil.com/signed-images/... are authentic.Why?
TLDR
All images are signed with your secret key. Trying to modify the data will invalidate the signature.
Continue reading to know the details.
Let's break it down. The URL can be broken down to several parts,
Item
Description
https://images.usestencil.com/signed-images/be6a052e-bce8-4c14-8bbb-ea6b6f9941d5/TEafv3AfNptmzii4zj2jkc.pngThis is the base URL
modifications=W3sibmFtZSI6InRleHRfY2FuZGlkYXRlIiwidGV4dCI6IkpvaG4gV2ljayJ9XQBase64 encoded modifications
s=f69736c6f17cea118a45dc018103694cbde78d89513de977c2fa1c55faf697dfSignature that we use to determine the authenticity of the request
If we decode the base64 modifications, we will get the following output,
1
[{"name":"text_candidate","text":"John Wick"}]
Copied!
You might think, "Hey what if I modify the value and encode it back. That should work, right?"
Let's just do that. We changed the value to
John the Impostor and got back the following base64 encoded string.1
[{"name":"text_candidate","text":"John the Impostor"}]
2
​
3
W3sibmFtZSI6InRleHRfY2FuZGlkYXRlIiwidGV4dCI6IkpvaG4gdGhlIEltcG9zdG9yIn1d
Copied!
Putting everything together we get back,
1
https://images.usestencil.com/signed-images/be6a052e-bce8-4c14-8bbb-ea6b6f9941d5/TEafv3AfNptmzii4zj2jkc.png?modifications=W3sibmFtZSI6InRleHRfY2FuZGlkYXRlIiwidGV4dCI6IkpvaG4gdGhlIEltcG9zdG9yIn1d&s=f69736c6f17cea118a45dc018103694cbde78d89513de977c2fa1c55faf697df
Copied!
Visiting the URL gave us the following image instead,
Invalid image
If you look at the response header, you should see the following header
x-stencil-error: Invalid signatureThe reason is that, the signature doesn't contain the right modifications and thus rejected by our server. By ensuring the image is signed with our secret key, we can ensure image authenticity. Simple, right?
No-code URL generation
As you can see, we have to run one Python script to generate the link for our certificate. There are few things we can do so that we don't have to run the Python script each time. Here are few options you can explore to do this.
1. AWS Lambda
You can modify the Python script as a lambda function that accepts the candidate's name and when run, it will return the generated URL.
You can then combine this with other tools such as Airtable where you can input list of names, and use any automation services like Zapier, Integromat, UiPath and others to run the lambda function when your Airtable rows are added/updated and update the corresponding rows with the generated link.
2. Airtable
Airtable has scripting ability and you can write a similar script to generate the link.
3. Google Sheet
Google Sheet also has scripting ability and you can write a similar script to generate the link.
There are numerous of ways to do this and these are just some of them.