OpenID for Verifiable Presentations 1.0

Note

OpenID Foundation specification, final version 1.0, defining a protocol for requesting and presenting credentials (OpenID4VP).

Summary

Purpose

The OpenID Foundation’s OpenID for Verifiable Presentations 1.0 (OpenID4VP) specification defines how a verifier requests credentials and how the wallet presents them OpenID4VP 1.0:

The mechanism is built on OAuth 2.0. It accepts any credential format, including the W3C data model, ISO mdoc and SD-JWT VC. The specification also describes its use with the browsers’ Digital Credentials API, in its Appendix A OpenID4VP 1.0, [1.](#section-1) [Introduction](#name-introduction).

Who it applies to

The specification imposes nothing by itself. Wallet providers ensure that wallet solutions support the presentation of attributes to relying parties in accordance with Annex II to Implementing Regulation 2024/2982 Art. 5(1). That annex makes clauses 4.1, 4.2, 5 and 6 of specification ETSI TS 119 472-2 V1.2.1 applicable, with adaptations Annex II.

The reference mainly runs through this intermediate standard. Its clause 6 defines a profile based on OpenID4VC-HAIP ETSI TS 119 472-2 V1.2.1, § 6.1 Introduction, and the protocols of that profile are themselves based on OpenID4VP ETSI TS 119 472-2 V1.2.1, § 1 Scope. Annex II requires in particular that relying parties and wallets meet the mandatory requirements of several sections of OpenID4VC-HAIP Annex II; this reference is detailed in the summary of OpenID4VC-HAIP OpenID4VC HAIP 1.0.

Key points

• A single direct mention. Annex II names OpenID4VP for the x509_hash client identifier prefix of section 5.9.3: the end-entity certificate to be used with this prefix is a wallet-relying party access certificate within the meaning of ETSI TS 119 475 Annex II. In the specification, this prefix binds the verifier’s identifier to the hash of the certificate that signs the request OpenID4VP 1.0, [5.9.3.](#section-5.9.3) [Defined Client Identifier Prefixes](#name-defined-client-identifier-p).
• The registration certificate in the request. One of the elements of the verifier_info parameter includes the relying party’s registration certificate Annex II. The specification presents this parameter as optional and cites the registration certificate among its examples OpenID4VP 1.0, [5.11.](#section-5.11) [Verifier Info](#name-verifier-info).
• A caveat on redirects. The wallet should not support the redirects-based mechanism for cross-device flows. The annex describes it as vulnerable, in particular to session fixation, leaves mitigation to relying parties and states that implementing it should not lead to non-compliance Annex II. The specification itself addresses this risk in its security considerations OpenID4VP 1.0, [14.2.](#section-14.2) [Session Fixation](#name-session-fixation).
• At issuance too. Through Annex I to the same regulation, specification ETSI TS 119 472-3 applies with adaptations Annex I. It gives the issuer_info parameter of the PID or attestation provider the same structure as the verifier_info parameter of OpenID4VP ETSI TS 119 472-3 V1.1.1, § 4.2.3 Provision of registration certificates of PID/EAA Provider to EUDI Wallet.

Passages of the acts that relate to it

• Annex II: requirement OIDFVP-HAIP-COMMON-REQ-RO-23 (section 5.9.3 of OpenID4VP) and OpenID4VC-HAIP profile of the adapted ETSI specification.
• Annex I: adapted specification ETSI TS 119 472-3.
• These two annexes were added by Implementing Regulation 2026/1731, which deleted the original annex Art. 4; the site cites the consolidated version that incorporates it.

Links

• Related standards: OpenID4VC-HAIP OpenID4VC HAIP 1.0, OpenID4VCI OpenID4VCI 1.0.
• Intermediate standards: ETSI TS 119 472-2 ETSI TS 119 472-2 V1.2.1 and ETSI TS 119 472-3 ETSI TS 119 472-3 V1.1.1.
• Learning path: step 3, the European wallet.

Written by Asphalia.