The paper card that made Key to NYC’s digital pass work

The week

On August 3, 2021, New York City Mayor Bill de Blasio announced the Key to NYC program, requiring proof of at least one dose of a COVID-19 vaccine for indoor dining, gyms and indoor entertainment. It was the first such requirement by a major US city. It took effect on August 16, with enforcement from September 13. Accepted proof included the paper CDC vaccination card or a photo of it, the city’s NYC COVID Safe app, New York State’s Excelsior Pass, and other official records. Excelsior Pass, launched by the state in March 2021, produced a digitally signed, scannable credential from state immunization records. An Excelsior Pass Plus version compatible with the SMART Health Cards standard was introduced that August. Several other states, including California, had begun issuing verifiable digital vaccination records using that standard.

Vaccine passes were among the most politically charged technologies of the pandemic, and the public argument was mostly about apps. For agency leaders, Key to NYC is more useful as a case study in credential design, because the same structure applies to mobile driver’s licenses, digital benefit cards, permits and professional licenses. Any government credential has three parts that must work together: issuance, how the credential is created from an authoritative record; verification, how someone else checks it; and fallback, what happens for people the digital version fails. New York’s experience shows that the third part decided whether the first two could be imperfect without breaking the program.

Issuance: the registry is the product

A digital vaccination credential is only as good as the record behind it. Excelsior Pass drew on the state’s immunization information system and New York City’s registry. When a resident’s record was complete and their name and date of birth matched, a pass appeared in minutes. When records were incomplete, carried a typo, or reflected a dose given in another state, at a federal site or abroad, the resident got an error message and had to seek a correction from a provider or the health department.

That pattern is general. The user experience of a digital credential is set by the quality of the underlying records and the speed of the correction process, not by the app’s interface. An agency launching a credential should measure, before launch, what share of eligible residents have a record that will match, and staff a correction channel sized for the rest. Corrections also need a clear owner. A resident told to “contact your provider” about a mass vaccination site that has closed has nowhere to go.

The city’s own app showed the opposite trade-off. NYC COVID Safe let users store a photo of their card, which was easy for anyone to use but verified nothing. Issuance without an authoritative record is convenience, not a credential.

Issuance also has to bind the credential to the right person. Retrieving a record by matching a handful of personal details is quick, but anyone who knows those details can retrieve it too. Stronger identity proofing at issuance raises assurance and cuts uptake. Each agency has to choose that balance deliberately for its credential, and write the choice down, instead of inheriting it from a vendor’s default flow.

Verification: businesses as reluctant checkpoints

Verification fell on private businesses. Restaurant hosts, gym receptionists and theater ushers became the people checking credentials, usually alongside a photo ID. They had seconds per customer, no training in document fraud and every commercial incentive to avoid confrontation.

Signed, scannable credentials such as Excelsior Pass and SMART Health Cards solved part of this. A verifier app could confirm in a second that the code was issued by the state and had not been altered. Reporting at the time suggested many venues glanced at the screen rather than scanning it, and paper cards could only be inspected by eye. Verification strength in the field was set by the weakest accepted format and the busiest host stand.

Verification also carries a privacy design question. A good verifier shows only what the check requires, here a name and a valid status, and keeps no record. A poor one stores scans, revealing where people have been. Agencies should specify verifier behavior as carefully as the credential itself, publish what verifiers can and cannot see, and test vendor apps against that specification.

Fallback: the paper card held the program together

Key to NYC accepted the paper CDC card. That choice weakened fraud resistance, and counterfeit cards were a known problem. It also meant that nobody was shut out for lack of a smartphone, a matching registry record or the skills to use an app. Residents who found the digital pass easier used it. Everyone else carried paper.

The fallback did a second, less visible job. It took load off the digital system. Registry errors did not stop anyone from eating indoors, because a resident with a bad record could still show a card. Verifier confusion at the door had a simple resolution. Because the app was a convenience and not a gate, its failures became inconveniences rather than exclusions.

The fallback also shaped adoption. Digital passes spread because many people found them easier than carrying a card, not because they were compelled. That is the healthiest kind of adoption for a government credential: chosen, and therefore resilient to the next failure.

The trade-off is real. Accepting paper lowered assurance. An agency must decide how much fraud risk a fallback introduces for its specific use. For a dining requirement, the answer tolerated a lot. For a credential that grants access to money or secure facilities, the fallback might need to be an in-person check rather than a piece of card stock. The principle holds either way. Plan the non-digital path first, size it for the people the digital path will fail, and remove it only when evidence shows the digital option works for nearly everyone.

With hindsight

From 2026, Key to NYC was short-lived. The city lifted the requirement for indoor venues in March 2022 as case rates fell, and vaccine passes faded across the United States. SMART Health Cards remain available from many state immunization systems. The credential lessons have outlasted the program. Mobile driver’s licenses, built on the ISO/IEC 18013-5 standard published in 2021, have spread to a growing number of states, and TSA accepts several at airport checkpoints, while physical licenses remain valid everywhere. The mobile license programs that have worked best show the same pattern as Key to NYC: an authoritative issuing record, a verifier designed to reveal only what is needed, and a physical alternative that keeps anyone from being shut out while adoption grows. Agencies planning digital benefit cards or permits face the same three choices.