---
title: "Issue a credential directly (management)"
method: POST
path: "/v1/credentials/issue"
tags: ["Credentials"]
---

# Issue a credential directly (management)

`POST /v1/credentials/issue`

Issue a verifiable credential to a holder from a credential template. Provide the template id, the holder's public JWK (used as the credential's key-binding confirmation key so only that holder can present it), and the claim values keyed by claim name as declared on the template's schema. Optionally pass a source_session_id to bridge a Didit verification session to the issued credential (the capture-to-issue link). The credential is signed with the tenant's active signing key and returned as a `dc+sd-jwt` string. The referenced template must belong to the authenticated tenant, otherwise the request returns 404. Requires Authorization: Bearer <tenant API key>.

## Request body

- object
  - `template_id` string, uuid, required — UUID of the credential template to issue from. Must reference a template owned by the authenticated tenant; otherwise the request returns 404. The template's schema determines the vct, format, and which claims are selectively disclosable.
  - `holder_jwk` object, required — The holder's public key as a JSON Web Key (JWK). It is bound into the credential as the key-binding confirmation (cnf) key, so only the wallet holding the matching private key can later present the credential.
  - `claims` object, required — The credential claim values, keyed by claim name. Each key should match an attribute name declared on the template's schema; the corresponding value populates that claim in the issued credential.
  - `source_session_id` string — Optional identifier of the Didit verification session whose captured data backs this credential (the capture-to-issue bridge). Stored on the issued credential for traceability. Defaults to an empty string.

## Response `200`

No response body

## Other responses

- `201` — The credential was issued and signed. Returns the credential identifier, its type, the serialized SD-JWT, and its index in the tenant's status list.

## Changes

- **2026-06-30** `1ee4908e9af4` — 1 breaking
  - request body became required

[Change history](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/changes/v1/credentials/issue/post.md)

---

[API](https://skmtc.dev/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.dev/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/1ee4908e9af4/schema)