OpenID for Verifiable Credential Issuance

https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html
Admin
OpenID for Verifiable Credential Issuance defines an OAuth 2.0-based API protocol for issuing...
Tokens:66,849
Snippets:329
Trust Score:9.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Fetch Credential Offer by Reference via GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of the HTTP GET request the Wallet sends to retrieve a Credential Offer referenced by credential_offer_uri. The request is sent to the URI unless the offer is already cached.

```http
GET /credential_offer HTTP/1.1
Host: server.example.com

```

--------------------------------

### Credential Offer JSON Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Offer object offering two credentials with a pre-authorized code grant and transaction code requirements.

```json
{
  "credential_issuer": "https://credential-issuer.example.com",
  "credential_configuration_ids": [
    "UniversityDegreeCredential",
    "org.iso.18013.5.1.mDL"
  ],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "oaKazRN8I0IbtZ0C7JuMn5",
      "tx_code": {
        "length": 4,
        "input_mode": "numeric",
        "description": "Please provide the one-time code that was sent via e-mail"
      }
    }
  }
}
```

--------------------------------

### mso_mdoc credential_configurations_supported example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of the credential_configurations_supported parameter for the mso_mdoc format. Shows the required doctype, cryptographic binding method, signing algorithms (-7 and -9), and display/claims metadata for an mDL credential.

```json
{
  "credential_configurations_supported": {
    "org.iso.18013.5.1.mDL": {
      "format": "mso_mdoc",
      "doctype": "org.iso.18013.5.1.mDL",
      "cryptographic_binding_methods_supported": [
        "cose_key"
      ],
      "credential_signing_alg_values_supported": [
        -7, -9
      ],
      "credential_metadata": {
        "display": [
          {
            "name": "Mobile Driving License",
            "locale": "en-US",
            "logo": {
              "uri": "https://state.example.org/public/mdl.png",
              "alt_text": "state mobile driving license"
            },
            "background_color": "#12107c",
            "text_color": "#FFFFFF"
          },
          {
            "name": "モバイル運転免許証",
            "locale": "ja-JP",
            "logo": {
              "uri": "https://state.example.org/public/mdl.png",
              "alt_text": "米国州発行のモバイル運転免許証"
            },
            "background_color": "#12107c",
            "text_color": "#FFFFFF"
          }
        ],
        "claims": [
          {
            "path": ["org.iso.18013.5.1", "given_name"],
            "display": [
              {
                "name": "Given Name",
                "locale": "en-US"
              },
              {
                "name": "名前",
                "locale": "ja-JP"
              }
            ]
          },
          {
            "path": ["org.iso.18013.5.1", "family_name"],
            "display": [
              {
                "name": "Surname",
                "locale": "en-US"
              }
            ]
          },
          {
            "path": ["org.iso.18013.5.1", "birth_date"],
            "mandatory": true
          },
          {"path": ["org.iso.18013.5.1.aamva", "organ_donor"]}
        ]
      }
    }
  }
}
```

--------------------------------

### mso_mdoc authorization details example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of an authorization details object for the mso_mdoc format. References the credential configuration by ID and requests specific claims by path.

```json
[
  {
    "type": "openid_credential",
    "credential_configuration_id": "org.iso.18013.5.1.mDL",
    "claims": [
      {"path": ["org.iso.18013.5.1","given_name"]},
      {"path": ["org.iso.18013.5.1","family_name"]},
      {"path": ["org.iso.18013.5.1","birth_date"]},
      {"path": ["org.iso.18013.5.1.aamva","organ_donor"]}
    ]
  }
]
```

--------------------------------

### Send Credential Offer by Value via GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Offer passed by value using the credential_offer parameter. The URL-encoded JSON includes credential_issuer, credential_configuration_ids, and grants with a pre-authorized_code grant type. Line breaks within values are for display purposes only.

```http
GET /credential_offer?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22UniversityDegree_JWT%22,%
  22org.iso.18013.5.1.mDL%22%5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-
  type:pre-authorized_code%22:%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7
  JuMn5%22,%22tx_code%22:%7B%7D%7D%7D%7D

```

--------------------------------

### Example JSON Credential for Claims Path Pointer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

A simplified JSON-based Credential used to illustrate claims path pointer semantics for ISO mdoc-based credentials. The example includes nested objects and arrays to demonstrate selection of claims.

```json
{
  "name": "Arthur Dent",
  "address": {
    "street_address": "42 Market Street",
    "locality": "Milliways",
    "postal_code": "12345"
  },
  "degrees": [
    {
      "type": "Bachelor of Science",
      "university": "University of Betelgeuse"
    },
    {
      "type": "Master of Science",
      "university": "University of Betelgeuse"
    }
  ],
  "nationalities": ["British", "Betelgeusian"]
}
```

--------------------------------

### Pushed Authorization Request (PAR) example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Pushed Authorization Request sent to the PAR endpoint. Includes OAuth-Client-Attestation and OAuth-Client-Attestation-PoP headers, and authorization_details parameter.

```http
POST /par HTTP/1.1
Host: server.example.com
OAuth-Client-Attestation: eyJ...
OAuth-Client-Attestation-PoP: eyJ...
Content-Type: application/x-www-form-urlencoded

response_type=code
&client_id=CLIENT1234
&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
&code_challenge_method=S256
&redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
&authorization_details=...

```

--------------------------------

### di_vp Proof Type Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a `proofs` parameter using the `di_vp` proof type. The W3C Verifiable Presentation must be secured with a Data Integrity Proof, with `proofPurpose` set to `authentication`, `domain` set to the Credential Issuer Identifier, and `challenge` set to the server-provided `c_nonce` when required. Line breaks within values are for display purposes only.

```json
{
  "di_vp": [
    {
      "@context": [
        "https://www.w3.org/ns/credentials/v2",
        "https://www.w3.org/ns/credentials/examples/v2"
      ],
      "type": [
        "VerifiablePresentation"
      ],
      "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
      "proof": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-2022",
          "proofPurpose": "authentication",
          "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5
           XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
          "created": "2023-03-01T14:56:29.280619Z",
          "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
          "domain": "did:web:audience.company.com",
          "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACi
           WFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
        }
      ]
    }
  ]
}
```

--------------------------------

### mso_mdoc Credential Response example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Response for an mso_mdoc credential. The credential claim contains the base64url-encoded CBOR-encoded IssuerSigned structure.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "credentials": [
    {
      "credential": "omppc3N1ZXJBdXRohEOhASahG...ArQwggKwMIICVqADAgEC"
    }
  ]
}
```

--------------------------------

### Key Attestation in JWT format example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Example of a key attestation in JWT format, showing the JOSE header and the JWT body with the required and optional claims. The header includes the typ, alg, and x5c elements, while the body contains iss, iat, exp, key_storage, user_authentication, and attested_keys.

```json
{
  "typ": "key-attestation+jwt",
  "alg": "ES256",
  "x5c": ["MIIDQjCCA..."]
}
.
{
  "iss": "<identifier of the issuer of this key attestation>",
  "iat": 1516247022,
  "exp": 1541493724,
  "key_storage": [ "iso_18045_moderate" ],
  "user_authentication": [ "iso_18045_moderate" ],
  "attested_keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  ]
}
```

--------------------------------

### Authorization Details Example for jwt_vc_json

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of an authorization details object for the jwt_vc_json credential format. It requests specific claims from the credential subject using JSON paths.

```json
[
  {
    "type": "openid_credential",
    "credential_configuration_id": "UniversityDegreeCredential",
    "claims": [
      {"path": ["credentialSubject", "given_name"]},
      {"path": ["credentialSubject", "family_name"]},
      {"path": ["credentialSubject", "degree"]}
    ]
  }
]
```

--------------------------------

### Example of `proofs` parameter with JWT proof and decoded JWT

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a `proofs` parameter with a JWT proof, followed by the decoded JWT showing the JOSE header and payload. The JWT header includes `typ` set to `openid4vci-proof+jwt`, `alg` ES256, and a `jwk`; the payload contains `aud`, `iat`, and `nonce`.

```json
{
  "jwt": [
    "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2Iiwiand
    rIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiblVXQW9BdjNYWml0aDh
    FN2kxOU9kYXhPTFlGT3dNLVoyRXVNMDJUaXJUNCIsInkiOiJIc2tIVThCalVpMVU
    5WHFpN1N3bWo4Z3dBS18weGtjRGpFV183MVNvc0VZIn19.eyJhdWQiOiJodHRwcz
    ovL2NyZWRlbnRpYWwtaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAxOTYwND
    Q0LCJub25jZSI6IkxhclJHU2JtVVBZdFJZTzZCUTR5bjgifQ.-a3EDsxClUB4O3L
    eDD5DVGEnNMT01FCQW4P6-2-BNBqc_Zxf0Qw4CWayLEpqkAomlkLb9zioZoipdP-
    jvh1WlA"
  ]
}
```

```json
{
  "typ": "openid4vci-proof+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "nUWAoAv3XZith8E7i19OdaxOLYFOwM-Z2EuM02TirT4",
    "y": "HskHU8BjUi1U9Xqi7Swmj8gwAK_0xkcDjEW_71SosEY"
  }
}.{
  "aud": "https://credential-issuer.example.com",
  "iat": 1701960444,
  "nonce": "LarRGSbmUPYtRYO6BQ4yn8"
}
```

--------------------------------

### attestation Proof Type Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a `proofs` parameter using the `attestation` proof type. The key attestation is in JWT format, and if the Credential Issuer has a Nonce Endpoint, the `c_nonce` value must be provided in the key attestation's `nonce` parameter. Line breaks within values are for display purposes only.

```json
{
  "attestation": [
    "<key attestation in JWT format>"
  ]
}
```

--------------------------------

### GET request using request_uri

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of the GET request that might subsequently be sent by the Browser to the authorization server using the request_uri obtained from the PAR response.

```http
GET /authorize?client_id=s6BhdRkqt3
  &request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3A6esc_11ACC5bwc014ltc14eY22c
Host: server.example.com

```

--------------------------------

### Invoke Wallet with Credential Offer via openid-credential-offer://

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Offer that can be included in a QR code or a link used to invoke a Wallet deployed as a native app. Uses the openid-credential-offer:// URI scheme with a URL-encoded credential_offer parameter. Line breaks within values are for display purposes only.

```uri
openid-credential-offer://?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22org.iso.18013.5.1.mDL%22%
  5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-type:pre-authorized_code%22
  :%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7JuMn5%22,%22tx_code%22:%7B%
  22input_mode%22:%22text%22,%22description%22:%22Please%20enter%20the%20serial
  %20number%20of%20your%20physical%20drivers%20license%22%7D%7D%7D%7D

```

--------------------------------

### Credential Offer Response for Authorization Code Flow

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a response from the Credential Issuer that contains a Credential Offer Object used to encourage the Wallet to start an Authorization Code Flow. The response uses the application/json media type.

```http
HTTP/1.1 200 OK
Content-Type: application/json

{
  "credential_issuer": "https://credential-issuer.example.com",
  "credential_configuration_ids": [
    "UniversityDegreeCredential"
  ],
  "grants": {
    "authorization_code": {
      "issuer_state": "eyJhbGciOiJSU0Et...FYUaBy"
    }
  }
}

```

--------------------------------

### Credential Issuer Metadata for ldp_vc format

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of the credential_configurations_supported parameter for the ldp_vc credential format. Shows required credential_definition with @context and type arrays, plus optional credential_metadata with claims and display information.

```json
{
  "credential_configurations_supported": {
    "UniversityDegree_LDP_VC": {
      "format": "ldp_vc",
      "cryptographic_binding_methods_supported": [
        "did:example"
      ],
      "credential_signing_alg_values_supported": [
        "Ed25519Signature2018"
      ],
      "credential_definition": {
        "@context": [
          "https://www.w3.org/2018/credentials/v1",
          "https://www.w3.org/2018/credentials/examples/v1"
        ],
        "type": [
          "VerifiableCredential",
          "UniversityDegreeCredential"
        ]
      },
      "credential_metadata": {
        "claims": [
          {
            "path": ["credentialSubject", "given_name"],
            "display": [
              {
                "name": "Given Name",
                "locale": "en-US"
              }
            ]
          },
          {
            "path": ["credentialSubject", "family_name"],
            "display": [
              {
                "name": "Surname",
                "locale": "en-US"
              }
            ]
          },
          {
            "path": ["credentialSubject", "degree"]
          },
          {
            "path": ["credentialSubject", "gpa"],
            "mandatory": true,
            "display": [
              {
                "name": "GPA"
              }
            ]
          }
        ],
        "display": [
          {
            "name": "University Credential",
            "locale": "en-US",
            "logo": {
              "uri": "https://university.example.edu/public/logo.png",
              "alt_text": "a square logo of a university"
            },
            "background_color": "#12107c",
            "text_color": "#FFFFFF"
          }
        ]
      }
    }
  }
}
```

--------------------------------

### QR Code Credential Offer by Reference via openid-credential-offer://

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Offer by reference displayed as a QR code. Uses the openid-credential-offer:// URI scheme with a URL-encoded credential_offer_uri parameter. This approach is useful for large Credential Offer objects due to QR code size limitations.

```uri
openid-credential-offer://?
  credential_offer_uri=https%3A%2F%2Fserver%2Eexample%2Ecom%2Fcredential-offer
  %2FGkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM

```

--------------------------------

### GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

```APIDOC
## GET /credential_offer

### Description
Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

### Method
GET

### Endpoint
/credential_offer

### Parameters
#### Path Parameters
- **credential_offer_uri** (string) - Required - The URI from which the Credential Offer Object is retrieved.

### Request Example
GET /credential_offer HTTP/1.1
Host: server.example.com

### Response
#### Success Response (200)
- **Content-Type** (string) - Must be `application/json`.
- **credential_issuer** (string) - The Credential Issuer identifier.
- **credential_configuration_ids** (array of strings) - List of Credential Configuration identifiers.
- **grants** (object) - Object containing grant type information.

#### Response Example
HTTP/1.1 200 OK
Content-Type: application/json

{
  "credential_issuer": "https://credential-issuer.example.com",
  "credential_configuration_ids": [
    "UniversityDegreeCredential"
  ],
  "grants": {
    "authorization_code": {
      "issuer_state": "eyJhbGciOiJSU0Et...FYUaBy"
    }
  }
}
```

--------------------------------

### Credential Response Example for jwt_vc_json

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html

Non-normative example of a Credential Response for the jwt_vc_json format. The credential claim contains a JWT that must not be re-encoded; line breaks within values are for display only.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store

{
  "credentials": [
    {
      "credential": "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiIsImtpZCI6I
      nVybjppZXRmOnBhcmFtczpvYXV0aDpqd2stdGh1bWJwcmludDpzaGEtMjU2O
      m1sVXBvZzd2RWV3RkJlbTZVbDA5YzJkdFR3YzhkRnpWcElEWDNzcUdXVzAif
      Q.eyJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC
      9jcmVkZW50aWFscy92MSIsImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZW
      RlbnRpYWxzL2V4YW1wbGVzL3YxIl0sImlkIjoiaHR0cHM6Ly9jcmVkZW50aW
      FsLWlzc3Vlci5leGFtcGxlLmNvbS9jcmVkZW50aWFscy8zNzMyIiwidHlwZS
      I6WyJWZXJpZmlhYmxlQ3JlZGVudGlhbCIsIlVuaXZlcnNpdHlEZWdyZWVDcm
      VkZW50aWFsIl0sImlzc3VlciI6Imh0dHBzOi8vY3JlZGVudGlhbC1pc3N1ZX
      IuZXhhbXBsZS5jb20iLCJpc3N1YW5jZURhdGUiOiIyMDI1LTAxLTAxVDAwOj
      AwOjAwWiIsImNyZWRlbnRpYWxTdWJqZWN0Ijp7ImlkIjoiZGlkOmp3azpleU
      pyYVdRaU9pSjFjbTQ2YVdWMFpqcHdZWEpoYlhNNmIyRjFkR2c2YW5kckxYUm
      9kVzFpY0hKcGJuUTZjMmhoTFRJMU5qcFdZa3BQVTNacWVGVTJURGhETjBkVl
      R6UmtjMmhKV1ZZemVtSjJSbmRyV1VJME0xbEtOVXQwZERoRklpd2lhM1I1SW
      pvaVJVTWlMQ0pqY25ZaU9pSlFMVEkxTmlJc0ltRnNaeUk2SWtWVE1qVTJJaX
      dpZUNJNkklrMWtReTFQUzNFMFFWRktabFpEV0RWNmNGRnZURGhxTkZaRlpuWl
      FXRGs0ZEZVNWFIaGpUbGhIY204aUxDSjVJam9pYm5OWGJtWmlOazVYYzBzek
      9VSklMV2hCWVZOclExTmxORUo1YldWT2MyTktSVjl6WVVRelJETmlUU0o5Ii
      wiZGVncmVlIjp7InR5cGUiOiJCYWNoZWxvckRlZ3JlZSIsIm5hbWUiOiJCYW
      NoZWxvciBvZiBTY2llbmNlIGFuZCBBcnRzIn19fSwiaXNzIjoiaHR0cHM6Ly
      9jcmVkZW50aWFsLWlzc3Vlci5leGFtcGxlLmNvbSIsIm5iZiI6MTczNTY4OT
      YwMCwianRpIjoiaHR0cHM6Ly9jcmVkZW50aWFsLWlzc3Vlci5leGFtcGxlLm
      NvbS9jcmVkZW50aWFscy8zNzMyIiwic3ViIjoiZGlkOmp3azpleUpyYVdRaU
      9pSjFjbTQ2YVdWMFpqcHdZWEpoYlhNNmIyRjFkR2c2YW5kckxYUm9kVzFpY0
      hKcGJuUTZjMmhoTFRJMU5qcFdZa3BQVTNacWVGVTJURGhETjBkVlR6UmtjMm
      hKV1ZZemVtSjJSbmRyV1VJME0xbEtOVXQwZERoRklpd2lhM1I1SWpvaVJVTW
      lMQ0pqY25ZaU9pSlFMVEkxTmlJc0ltRnNaeUk2SWtWVE1qVTJJaXdpZUNJNk
      lrMWtReTFQUzNFMFFWRktabFpEV0RWNmNGRnZURGhxTkZaRlpuWlFXRGs0ZE
      ZVNWFIaGpUbGhIY204aUxDSjVJam9pYm5OWGJtWmlOazVYYzBzek9VSklMV2
      hCWVZOclExTmxORUo1YldWT2MyTktSVjl6WVVRelJETmlUU0o5In0.k13xQC
      nQIKAIuwQIbg37dwlNr8D6_2YUQtDTVQCq-ZsjcXxHagGC_VIZtd7RpR8OvB
      zTBHVwrBRD-_RzoV2Ofg"
    }
  ]
}
```
Tokens:
Raw