OpenID for Verifiable Credential Issuance

https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md
Admin
OpenID for Verifiable Credential Issuance defines an OAuth 2.0-protected API for issuing Verifiable...
Tokens:53,649
Snippets:297
Trust Score:9.9
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Fetch Credential Offer by Reference with HTTP GET

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of the HTTP GET request the Wallet sends to retrieve a Credential Offer referenced by credential_offer_uri, unless it is already cached.

```http
GET /credential_offer HTTP/1.1
Host: server.example.com
```

--------------------------------

### Send Credential Offer by Value with credential_offer Parameter

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer passed by value using the credential_offer parameter in a GET request. Line breaks within values are for display purposes only.

```http
GET /credential_offer?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22UniversityDegree_JWT%22,%
  22org.iso.18013.5.1.mDL%22%5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-
  type:pre-authorized_code%22:%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7
  JuMn5%22,%22tx_code%22:%7B%7D%7D%7D%7D
```

--------------------------------

### Nonce Response Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Nonce Response with a c_nonce value and an optional DPoP-Nonce header. The response must include Cache-Control: no-store.

```http
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
DPoP-Nonce: eyJ7S_zG.eyJH0-Z.HX4w-7v

{
  "c_nonce": "wKI4LT17ac15ES9bw8ac4"
}
```

--------------------------------

### di_vp proof type example in proofs parameter

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of the `proofs` parameter for the `di_vp` proof type. The W3C Verifiable Presentation must be secured with a Data Integrity Proof, with `proofPurpose` set to `authentication`, `domain` set to the Credential Issuer Identifier, and `challenge` set to the server-provided `c_nonce` when required. Line breaks within values are for display purposes only.

```json
{
  "di_vp": [
    {
      "@context": [
        "https://www.w3.org/ns/credentials/v2",
        "https://www.w3.org/ns/credentials/examples/v2"
      ],
      "type": [
        "VerifiablePresentation"
      ],
      "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
      "proof": [
        {
          "type": "DataIntegrityProof",
          "cryptosuite": "eddsa-2022",
          "proofPurpose": "authentication",
          "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5
           XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
          "created": "2023-03-01T14:56:29.280619Z",
          "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
          "domain": "did:web:audience.company.com",
          "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7ACi
           WFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
        }
      ]
    }
  ]
}
```

--------------------------------

### Nonce Request Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Nonce Request sent via HTTP POST to the nonce_endpoint. The request does not require an access token.

```http
POST /nonce HTTP/1.1
Host: credential-issuer.example.com
Content-Length: 0
```

--------------------------------

### Example of `proofs` parameter with JWT proof and decoded JWT

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Shows a non-normative example of a `proofs` parameter with a JWT proof, followed by its decoded JWT. The decoded JWT includes the required `typ` header `openid4vci-proof+jwt`, an `alg` of `ES256`, and a `jwk` header, along with the required `aud` and `iat` claims and an optional `nonce` claim.

```json
{
  "jwt": [
    "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2Iiwiand
    rIjp7Imt0eSI6IkVDIiwiY3J2IjoiUC0yNTYiLCJ4IjoiblVXQW9BdjNYWml0aDh
    FN2kxOU9kYXhPTFlGT3dNLVoyRXVNMDJUaXJUNCIsInkiOiJIc2tIVThCalVpMVU
    5WHFpN1N3bWo4Z3dBS18weGtjRGpFV183MVNvc0VZIn19.eyJhdWQiOiJodHRwcz
    ovL2NyZWRlbnRpYWwtaXNzdWVyLmV4YW1wbGUuY29tIiwiaWF0IjoxNzAxOTYwND
    Q0LCJub25jZSI6IkxhclJHU2JtVVBZdFJZTzZCUTR5bjgifQ.-a3EDsxClUB4O3L
    eDD5DVGEnNMT01FCQW4P6-2-BNBqc_Zxf0Qw4CWayLEpqkAomlkLb9zioZoipdP-
    jvh1WlA"
  ]
}
```

```json
{
  "typ": "openid4vci-proof+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "nUWAoAv3XZith8E7i19OdaxOLYFOwM-Z2EuM02TirT4",
    "y": "HskHU8BjUi1U9Xqi7Swmj8gwAK_0xkcDjEW_71SosEY"
  }
}.{
  "aud": "https://credential-issuer.example.com",
  "iat": 1701960444,
  "nonce": "LarRGSbmUPYtRYO6BQ4yn8"
}
```

--------------------------------

### Key Attestation JWT Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Key Attestation in JWT format. The JWT is signed by the Wallet Provider or the Wallet's key storage component and contains the required `typ` header `key-attestation+jwt`, a digital signature algorithm, and the `attested_keys` array. The example shows the JOSE header and the JWT body separated by a period.

```json
{
  "typ": "key-attestation+jwt",
  "alg": "ES256",
  "x5c": ["MIIDQjCCA..."]
}
.
{
  "iss": "<identifier of the issuer of this key attestation>",
  "iat": 1516247022,
  "exp": 1541493724,
  "key_storage": [ "iso_18045_moderate" ],
  "user_authentication": [ "iso_18045_moderate" ],
  "attested_keys": [
    {
      "kty": "EC",
      "crv": "P-256",
      "x": "TCAER19Zvu3OHF4j4W4vfSVoHIP1ILilDls7vCeGemc",
      "y": "ZxjiWWbZMQGHVWKVQ4hbSIirsVfuecCE6t4jT9F2HZQ"
    }
  ]
}
```

--------------------------------

### JSON-based Credential Example for Claims Path Pointers

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

A non-normative, simplified example of a JSON-based Credential used to illustrate claims path pointers. It contains nested objects, an array of objects, and an array of strings.

```json
{
  "name": "Arthur Dent",
  "address": {
    "street_address": "42 Market Street",
    "locality": "Milliways",
    "postal_code": "12345"
  },
  "degrees": [
    {
      "type": "Bachelor of Science",
      "university": "University of Betelgeuse"
    },
    {
      "type": "Master of Science",
      "university": "University of Betelgeuse"
    }
  ],
  "nationalities": ["British", "Betelgeusian"]
}
```

--------------------------------

### POST /token

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Documentation for the Token Endpoint, including the Token Request parameters and an example request.

```APIDOC
## [POST] /token

### Description
Exchanges an Authorization Code or Pre-Authorized Code for an Access Token and optionally a Refresh Token.

### Method
POST

### Endpoint
/token

### Parameters
#### Request Body
- **grant_type** (string) - Required - The grant type. For the Pre-Authorized Code Flow, use `urn:ietf:params:oauth:grant-type:pre-authorized_code`. For the Authorization Code Flow, use `authorization_code`.
- **code** (string) - Required for Authorization Code Flow - The Authorization Code obtained in a successful Authorization Response.
- **code_verifier** (string) - Required for Authorization Code Flow - The PKCE code verifier.
- **redirect_uri** (string) - Required for Authorization Code Flow - The redirect URI used in the Authorization Request.
- **client_assertion_type** (string) - Optional - The client assertion type, e.g., `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.
- **client_assertion** (string) - Optional - The client assertion value.
- **pre-authorized_code** (string) - Required if `grant_type` is `urn:ietf:params:oauth:grant-type:pre-authorized_code` - The code representing the authorization to obtain Credentials of a certain type.
- **tx_code** (string) - Optional - A Transaction Code value. MUST be present if a `tx_code` object was present in the Credential Offer.
- **authorization_details** (object) - Optional - If present, must be of type `openid_credential` and contain the Credential Issuer's identifier in the `locations` element when the Credential Issuer's metadata contains an `authorization_servers` parameter.
- **resource** (string) - Optional - The Credential Issuer's identifier value, recommended when using a scope value related to Credential issuance and the Credential Issuer's metadata contains an `authorization_servers` parameter.

### Request Example
```
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=SplxlOBeZQQYbYS6WxSbIA
&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk
&redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer
&client_assertion=eyJhbGciOiJSU...
```

### Response
#### Success Response (200)
- **access_token** (string) - The Access Token issued by the Authorization Server.
- **refresh_token** (string) - Optional - The Refresh Token, if issued.

#### Response Example
(Not provided in the source)

```

--------------------------------

### GET /credential_offer

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

```APIDOC
## GET /credential_offer

### Description
Retrieves a Credential Offer by reference using the `credential_offer_uri` parameter. The Wallet sends an HTTP GET request to the URI to retrieve the referenced Credential Offer Object.

### Method
GET

### Endpoint
/credential_offer

### Parameters
#### Query Parameters
- **credential_offer_uri** (string) - Required - URI that references a Credential Offer Object.

### Request Example
```
GET /credential_offer HTTP/1.1
Host: server.example.com
```

### Response
#### Success Response (200)
- **Content-Type** (string) - MUST be `application/json`.
- **Body** (object) - Credential Offer Object.

#### Response Example
```json
{
  "credential_issuer": "https://credential-issuer.example.com",
  "credential_configuration_ids": ["UniversityDegree_JWT"],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "oaKazRN8I0IbtZ0C7JuMn5",
      "tx_code": {}
    }
  }
}
```

```

--------------------------------

### Decoded Wallet Attestation JWT example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a decoded Wallet Attestation JWT. It includes the required claims for the client authentication method, such as 'iss', 'sub', 'cnf', and optional claims like 'wallet_name' and 'wallet_link'. The 'sub' claim is the client_id of the Wallet instance.

```json
{
  "typ": "oauth-client-attestation+jwt",
  "alg": "ES256",
  "kid": "11"
}
.
{
  "iss": "https://wallet-provider.example.com",
  "sub": "https://wallet.example.org",
  "wallet_name": "Wallet Solution X by Wonderland State Department",
  "wallet_link": "https://example.com/wallet/detail_info.html",
  "nbf": 1300815780,
  "exp": 1300819380,
  "cnf": {
    "jwk": {
      "kty": "EC",
      "use": "sig",
      "crv": "P-256",
      "x": "18wHLeIgW9wVN6VD1Txgpqy2LszYkMf6J8njVAibvhM",
      "y": "-V4dS4UaLMgP_4fY4j8ir7cl1TXlFdAgcx55o7TkcSA"
    }
  }
}
```

--------------------------------

### Browser GET Request with request_uri

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

GET request sent by the Browser to the Authorization Server using the request_uri obtained from the PAR response.

```HTTP
GET /authorize?client_id=s6BhdRkqt3
  &request_uri=urn%3Aietf%3Aparams%3Aoauth%3Arequest_uri%3A6esc_11ACC5bwc014ltc14eY22c
Host: server.example.com
```

--------------------------------

### Credential Request with di_vp proof for W3C VCDM

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Request for one Credential in W3C VCDM format using a Credential identifier from the Token Response and key proof type `di_vp`. Line breaks within values are for display purposes only.

```http
POST /credential HTTP/1.1
Host: server.example.com
Content-Type: application/json
Authorization: BEARER czZCaGRSa3F0MzpnWDFmQmF0M2JW

{
  "credential_identifier": "CivilEngineeringDegree-2023",
  "proofs": {
    "di_vp": [
      {
        "@context": [
          "https://www.w3.org/ns/credentials/v2",
          "https://www.w3.org/ns/credentials/examples/v2"
        ],
        "type": [
          "VerifiablePresentation"
        ],
        "holder": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
        "proof": [
          {
            "type": "DataIntegrityProof",
            "cryptosuite": "eddsa-2022",
            "proofPurpose": "authentication",
            "verificationMethod": "did:key:z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mq
             h5XPvLsrPsro#z6MkvrFpBNCoYewiaeBLgjUDvLxUtnK5R6mqh5XPvLsrPsro",
            "created": "2023-03-01T14:56:29.280619Z",
            "challenge": "82d4cb36-11f6-4273-b9c6-df1ac0ff17e9",
            "domain": "did:web:audience.company.com",
            "proofValue": "z5hrbHzZiqXHNpLq6i7zePEUcUzEbZKmWfNQzXcUXUrqF7bykQ7A
             CiWFyZdT2HcptF1zd1t7NhfQSdqrbPEjZceg7"
          }
        ]
      }
    ]
  }
}
```

--------------------------------

### Token Error Response Example

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Example of a Token Error Response with the invalid_request error code. The response includes the HTTP status code 400 and the error code in the JSON body.

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
Cache-Control: no-store

{
  "error": "invalid_request"
}
```

--------------------------------

### Credential Offer by Reference with credential_offer_uri

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer by reference, typically used in QR codes due to size limitations. The credential_offer_uri parameter contains the URL to fetch the Credential Offer Object.

```uri
openid-credential-offer://?
  credential_offer_uri=https%3A%2F%2Fserver%2Eexample%2Ecom%2Fcredential-offer
  %2FGkurKxf5T0Y-mnPFCHqWOMiZi4VS138cQO_V7PZHAdM
```

--------------------------------

### Credential Offer by Value for QR Code or Native App Link

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of a Credential Offer by value that can be included in a QR code or a link to invoke a Wallet deployed as a native app. Line breaks within values are for display purposes only.

```uri
openid-credential-offer://?
  credential_offer=%7B%22credential_issuer%22:%22https://credential-issuer.exam
  ple.com%22,%22credential_configuration_ids%22:%5B%22org.iso.18013.5.1.mDL%22%
  5D,%22grants%22:%7B%22urn:ietf:params:oauth:grant-type:pre-authorized_code%22
  :%7B%22pre-authorized_code%22:%22oaKazRN8I0IbtZ0C7JuMn5%22,%22tx_code%22:%7B%
  22input_mode%22:%22text%22,%22description%22:%22Please%20enter%20the%20serial
  %20number%20of%20your%20physical%20drivers%20license%22%7D%7D%7D%7D
```

--------------------------------

### Authorization Request with authorization_details

Source: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.md

Non-normative example of an Authorization Request using the authorization_details parameter with a single credential_configuration_id. Sent by the User Agent to the Authorization Server in response to an HTTP 302 redirect response by the Wallet. Line breaks within values are for display purposes only.

```http
GET /authorize?
  response_type=code
  &client_id=s6BhdRkqt3
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256
  &authorization_details=%5B%7B%22type%22%3A%20%22openid_credential%22%2C%20%22
    credential_configuration_id%22%3A%20%22UniversityDegreeCredential%22%7D%5D
  &redirect_uri=https%3A%2F%2Fwallet.example.org%2Fcb
  
Host: server.example.com
```
Tokens:
Raw