Issuance
Issuance API
Issue verifiable credentials to wallets using OpenID for Verifiable Credential Issuance (OID4VCI)
The Issuance API lets you create and deliver verifiable credentials to digital wallets using the OpenID for Verifiable Credential Issuance (OID4VCI) protocol.
How it works
- You create a credential offer specifying the template and claim values
- The wallet scans the offer URI (QR code or deep link)
- The wallet authenticates and exchanges the offer for an access token
- The wallet requests the credential using the access token
- The API signs and returns the credential
Grant types
Two authentication flows are supported:
| Flow | Use case | HAIP required |
|---|---|---|
| Pre-authorized code | Server-to-server, known holder | Yes |
| Authorization code | User-driven, PAR + PKCE | Yes |
Both can be included in the same credential offer. The wallet chooses which to use.
Endpoints
API endpoints (requires API key)
| Method | Path | Auth | Description |
|---|---|---|---|
POST | /oid4vci/offers | Secret key | Create a credential offer |
Protocol endpoints (no API key)
These are called by wallets. You don't interact with them directly:
| Method | Path | Description |
|---|---|---|
GET | /.well-known/openid-credential-issuer | Credential issuer metadata |
GET | /.well-known/oauth-authorization-server | Authorization server metadata |
POST | /oid4vci/par | Pushed Authorization Request |
GET/POST | /oid4vci/authorize | Authorization endpoint |
POST | /oid4vci/token | Token endpoint |
POST | /oid4vci/credential | Credential endpoint |
POST | /oid4vci/nonce | Nonce endpoint |
POST | /oid4vci/deferred | Deferred credential endpoint |
GET | /oid4vci/offers/:id | Get offer details |
GET | /oid4vci/offers/:id/status | Get offer status, returns { "status": "..." } |
Supported formats
| Format | Description |
|---|---|
mso_mdoc | ISO 18013-5 mobile documents |
dc+sd-jwt | SD-JWT Verifiable Credentials |
Security features
- DPoP (RFC 9449): Sender-constrained access tokens
- PKCE (RFC 7636): Proof Key for Code Exchange with S256
- Wallet attestation: Optional. When a wallet supplies an
attest_jwt_client_authclient assertion it is verified, but requests without one are accepted (the authorization server advertises bothnoneandattest_jwt_client_auth) - Key attestation: Bind credentials to hardware-backed keys
- Nonce binding: Prevent replay attacks on credential requests