Sign in
OpenID4VCI Protocol

Credential endpoint (holder proof-of-possession → SD-JWT VC)

OpenID4VCI credential endpoint. Exchanges a Bearer access token (from POST /v1/oauth/token) plus a holder proof-of-possession JWT for the issued SD-JWT VC. Requires Authorization: Bearer <access_token>. The proof JWT (typ openid4vci-proof+jwt) carries the holder's public key and must include the c_nonce minted by POST /v1/nonce as its nonce claim and the issuer's credential_issuer identifier as its aud. On success the access token, c_nonce, and offer are all consumed (single-use), the credential is bound to the holder key, and the SD-JWT VC is returned. Returns 401 if the Authorization header is missing/not Bearer, and 400 if the proof is missing or invalid (expired token/nonce, bad signature, wrong audience, etc.).

post/v1/credential

Request body

Example request

{
  "proof": {
    "proof_type": "jwt",
    "jwt": "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7Li4ufX0.eyJub25jZSI6Ik5LUVJZWC4uLiIsImF1ZCI6Imh0dHBzOi8vaWQuZGlkaXQubWUvdjEvaXNzdWVycy9zdW1taXQtY2x1YiIsImlhdCI6MTcxOTc2NTAwMH0.<signature>"
  }
}

Response

The issued SD-JWT VC.

credentialstring

The issued credential as a dc+sd-jwt (SD-JWT VC) string: the issuer-signed JWS followed by tilde-separated selective-disclosure segments, ending in a trailing tilde — <jws>~<disclosure>~<disclosure>~. The holder stores this and presents it (optionally with a key-binding JWT) to verifiers.

vctstring

Verifiable Credential Type of the issued credential (the schema's vct).

Example response

{
  "credential": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRjK3NkLWp3dCJ9.eyJ2Y3QiOiJNZW1iZXJzaGlwQ2FyZCIsImlzcyI6Imh0dHBzOi8vaWQuZGlkaXQubWUvdjEvaXNzdWVycy9zdW1taXQtY2x1YiIsLi4ufQ.<signature>~WyJzYWx0IiwgIm1lbWJlcl9pZCIsICJNLTkwNDIiXQ~WyJzYWx0IiwgImxldmVsIiwgInByZW1pdW0iXQ~",
  "vct": "MembershipCard"
}

Changes