OpenID for Verifiable Credential Issuance 1.0

Note

OpenID Foundation specification, final version 1.0, defining an API for the issuance of verifiable credentials (OpenID4VCI).

Summary

Purpose

The OpenID Foundation’s OpenID for Verifiable Credential Issuance 1.0 (OpenID4VCI) specification, in its final version of 16 September 2025, defines the issuance of Verifiable Credentials OpenID4VCI 1.0:

This application programming interface (API) is protected by OAuth 2.0: the wallet obtains, through OAuth 2.0, authorisation to receive credentials. The credentials may be of any format, including SD-JWT VC, ISO mdoc or the W3C data model OpenID4VCI 1.0, [1.](#section-1) [Introduction](#name-introduction).

Who it applies to

The specification imposes nothing by itself. Two implementing regulations refer to it.

• Wallet unit attestations. Wallet providers ensure that these attestations comply with Annex Ib to Implementing Regulation 2024/2979 Art. 6(2). That annex, inserted by Implementing Regulation 2026/1731, refers directly to OpenID4VCI Annex Ib Implementing Regulation (EU) 2026/1731. Its requirements concern in particular the wallet unit, the wallet provider, the authorisation server, the attestation issuer and the provider of person identification data Annex Ib.
• The issuance protocol. Wallet providers ensure that wallet solutions support the protocols and interfaces in Annex I to Implementing Regulation 2024/2982 Art. 4(1). That annex makes specification ETSI TS 119 472-3 V1.1.1 applicable, with adaptations Annex I. This intermediate standard relies on the OpenID4VC-HAIP profile, itself a profile of OpenID4VCI ETSI TS 119 472-3 V1.1.1, § 1 Scope.

Key points

Annex Ib defines the wallet instance attestation by reference to the specification:

• The wallet instance attestation must also be a JWT signed or sealed by the wallet provider by means of a compact JAdES signature compliant with the baseline B level Annex Ib. Appendix E describes this attestation as a client authentication method designed for wallets deployed as native applications OpenID4VCI 1.0, [Appendix E.](#appendix-E) [Wallet Attestations in JWT format](#name-wallet-attestations-in-jwt-).
• The key attestation follows Appendix D of the specification, extended by the annex Annex Ib OpenID4VCI 1.0, [Appendix D.](#appendix-D) [Key Attestations](#name-key-attestations).
• Transport. During issuance, the wallet unit sends the wallet instance attestation in the pushed authorisation request and in the token request, together with a proof of possession. Where needed during issuance, it places the key attestation in the proofs field of the credential request Annex Ib.
• Fields made mandatory. The specification presents wallet_name, wallet_link and status as optional OpenID4VCI 1.0, [Appendix E.](#appendix-E) [Wallet Attestations in JWT format](#name-wallet-attestations-in-jwt-). The annex requires wallet_name, whose value is the identifier of the solution on the list of wallet providers; wallet_link is only recommended there Annex Ib.
• The value iso_18045_high. It is required for key_storage and user_authentication where the key attestation refers to the wallet secure cryptographic device (WSCD) Annex Ib. According to the specification, this value indicates resistance to a “High” attack potential, equivalent to VAN.5 under ISO/IEC 18045 OpenID4VCI 1.0, [D.2.](#appendix-D.2) [Attack Potential Resistance](#name-attack-potential-resistance).
• The flows. According to the ETSI standard, the wallet supports the authorisation code flow and the pre-authorised code flow of the specification ETSI TS 119 472-3 V1.1.1, § 4.1 General requirements. Annex I to Implementing Regulation 2024/2982 voids requirement GEN-REQ-4.1-05 of that clause, which required PID providers using the pre-authorised flow to perform authorisation in physical presence, as well as the note that follows it; it also sets aside Annex A of the specification Annex I ETSI TS 119 472-3 V1.1.1, § 4.1 General requirements.

The annex refers to the address that the specification presents as that of its latest revision, incorporating errata; the corpus contains the final text of 16 September 2025 Annex Ib OpenID4VCI 1.0, [1.1.](#section-1.1) [Errata revisions](#name-errata-revisions).

Passages of the acts that relate to it

• Annex Ib: Appendices D, E and F.3 and sections 12.2.2 and 12.2.4 of the specification, named by the requirements of the annex.
• Annex I: adapted ETSI TS 119 472-3.

Links

• Related standards: OpenID4VC-HAIP OpenID4VC HAIP 1.0, OpenID4VP OpenID4VP 1.0, RFC 7519 (JWT) RFC 7519, Token Status List, an IETF draft draft-ietf-oauth-status-list-20, evaluation methodology CEM:2022 CEM:2022 R1.
• Intermediate standard: ETSI TS 119 472-3 ETSI TS 119 472-3 V1.1.1.
• Learning path: step 3, the European wallet.

Written by Asphalia.