GS1 Digital Link · Resolver Standard 1.2.0
By 2027 every register
can read a QR code.
GS1's Sunrise 2027 is running pilots in 48 countries, representing 88% of the world's GDP, to get 2D codes scanning at retail points of sale. The barcode does not die. It stops being the only thing on the pack. And the pack is where this gets expensive, because artwork locks a long time before a shelf date.
Conformant to GS1-Conformant Resolver Standard 1.2.0 · verified with GS1's official test suite · self-asserted, because there is nothing to be certified by
The mechanism
One URI.
Every answer about the unit.
A GS1 Digital Link is a web address that is also a barcode payload. The identifiers you already print are the path. The same code answers the till, the shopper, the recycler and the regulator, and it answers each of them differently.
Hover or focus a highlighted identifier.
Ask for that serial and get the serial's answer. Ask for something we hold nothing specific about and the resolver walks up the hierarchy on its own: serial, then lot, then product. The shopper's phone gets HTML, a supply chain system asking for a linkset gets JSON, and a French phone gets the French page, from the identical URI.
Conformance
There is no badge.
So here's the test suite.
GS1 does not certify resolvers. There is no badge, no registry, and no accreditation to hold up, which means every "GS1 certified" claim you have read in this category was decorative. Ours is self-asserted too. The difference is the next two columns: here is precisely what we implement, here is precisely what we do not, and the test suite is GS1's own and public, so you do not have to take our word for either.
Implemented, and test-verified
- ✓/.well-known/gs1resolver
- ✓RFC 9264 linkset, application/linkset+json
- ✓?linkType=linkset, and JSON-LD in the HTML
- ✓gs1:defaultLink enforced on every write
- ✓Qualifier hierarchy walks up: serial, then lot, then key
- ✓404 on an unregistered linkType, which is the 1.2.0 change
- ✓300 on ambiguity, 400 on invalid syntax
- ✓Content negotiation on Accept and Accept-Language
- ✓Compressed URIs expanded at the edge
- ✓Mod-10 and GMN check-character-pair validation
- ✓GTIN-8, 12 and 13 canonicalised to 14, issued length preserved
Not implemented
- We emit a plain QR symbol, not a GS1 QR Code. The payload is a conformant Digital Link URI; the symbology header is ]Q1, not ]Q3.
- Compression is unavailable for AIs 235, 7040, 417, GMN and GRAI. That is a gap in the upstream GS1 toolkit, and we fall back to correct uncompressed URIs rather than emit something wrong.
- No Data Matrix. QR only.
- No ISO 15415 print grading. Verify your press output with a grader.
- No EPCIS event trails. We resolve identity; we are not a traceability system.
Coverage
All 16 primary keys.
Every qualifier.
One of those 57 link types is gs1:dpp. That is all "DPP-ready" honestly means today, for us or for anybody else, and it is worth having: attach a passport to a product, a lot or a single unit and it resolves. Anyone selling you more certainty than that right now is selling you a roadmap.
Licences
We check that the GTIN
is actually yours.
A resolver that lets you publish any GTIN you can type will happily let you publish someone else's. Declare your GS1 Company Prefix once and every key you publish is checked against it, on every origin, every time, with overlapping prefixes detected. Restricted-circulation ranges are refused outright: internal 02 and 04 codes, in-store 2-series, coupons, Bookland. They are not yours to put on the open web, and a resolver that accepts them is helping you make a mess that ships on a pallet.
Verified
With registry credentials, your prefix is checked against the GS1 registry itself.
Attested
Without them, your prefix is recorded on your word. Still enforced on every publish, just not externally confirmed. We show you which of the two you are on, because the difference is yours to know.
Serialization
100,000 serials.
One database row.
Serials are derived, not stored. A run of a hundred thousand writes a single job row, and every serial in it is recomputed on demand from that job. The CSV and the print sheet reproduce the same serials, forever. Lose the export and re-derive it from the job id. Ask whether a serial in the wild is one of ours and we answer by recomputing it, not by looking it up, which is why the answer does not depend on a database we have to keep growing.
Minting is 1 credit per serial, so a hundred thousand serials is about $80 at the $799 Volume rate. Re-deriving a run you have already bought is free. The platforms that advertise unlimited codes cap you at somewhere between 3 and 50 of them at any price, so the useful claim is not that ours are cheap. It is that a million serialized units is a thing you can do here at all.
curl "https://taproute.io/api/v1/gs1/verify?serial=7F2A00001AK3VP7QZM" \
-H "Authorization: Bearer tr_..."
# { "issued": true,
# "jobId": "7f2a1b3c-9d4e-4f5a-8b6c-1d2e3f4a5b6c",
# "keyAi": "01", "keyValue": "09506000134352",
# "index": 42, "issuedAt": "2026-07-16T09:12:44.000Z" }
# A serial we never issued, or one edited by hand, fails the HMAC and answers:
# { "issued": false, "reason": "no batch of this workspace issued that serial" } The code has to survive
a printing press.
A GS1 carrier is not a marketing asset, and the failure mode is not "it looks bad", it is a pallet that will not scan. So the defaults are the standard's, not ours: a four-module quiet zone, which we measure in a test rather than assume, error correction M by default with Q and H available through the API, and a 0.495mm X-dimension target with the print sheet dimensioned in millimetres so it survives the trip to the printer.
And we will not put your logo in the middle of a GS1 carrier. On an ordinary marketing code, go ahead: drop in a logo and we quietly raise the error correction to H to pay for it. On a code that has to clear a till, no. This is the one place in the product where we say no to something you asked for.
Cost
A million serialized units.
About $1,600 a year.
Mint a million serials and that is a million credits. Scan every one of them once and that is another million. Two million credits is two $799 Volume packs, so $1,598, bought outright, nothing renewing. Enterprise GS1 resolver quotes for the same job run from $5,000 to $50,000 a year.
1,000,000 mints + 1,000,000 scans = 2,000,000 credits = 2 × $799 = $1,598
Questions
Are you GS1 certified?
No. Nobody is. GS1 does not issue a certification, a badge, or a registry for Digital Link resolvers, so every "GS1 certified" claim in this market is decoration. What is real: our resolver targets the GS1-Conformant Resolver Standard 1.2.0 and we verify it against GS1's own official public test suite. That claim is self-asserted, exactly like everyone else's, and the difference is that we are telling you so. It is also independently re-verifiable: the test suite is public, our resolver is public, go and run one against the other.
Is this DPP-ready?
gs1:dpp is one of the 57 GS1 Web vocabulary link types we support, so you can attach a Digital Product Passport to a GTIN, a lot or an individual serial today and it will resolve correctly. That is the whole of what "DPP-ready" honestly means right now, for us or for anyone. The regulatory detail is still moving, and a vendor promising you more than a working link type is selling you a roadmap.
What does a serialized run actually cost?
Every serial is a dynamic code, so it costs 1 credit to mint. A hundred thousand serials is a hundred thousand credits, which is roughly $80 at the $799 Volume rate. Re-deriving a run you already bought is free: ask for the same job again and you get byte-identical serials, because they were never stored to begin with. For scale: minting and then scanning a million serialized units for a year is about $1,600, against enterprise GS1 quotes that run from $5,000 to $50,000.
Do I need my own GS1 Company Prefix?
Yes, and we check it. You declare your prefix in the dashboard and every key you publish is validated against it, on every origin, every time. A resolver that lets you publish any GTIN you type will happily let you publish someone else's, and that is not a feature. If you give us registry credentials we verify the prefix against the GS1 registry; without them it is recorded as attested rather than verified, and we show you which of the two you are on.
Can the resolver run on my own domain?
Yes, and on every pack: a custom domain is a matter of credits here, not of tier. Point a subdomain you own at us with one CNAME and your Digital Links resolve under your own hostname. From the Growth pack up the first domain is included free. This matters more for GS1 than anywhere else, because the URI is printed on the pack and it is going to outlive the campaign.