---
title: "Provide a self-contained nonce in a publicly accessible endpoint."
method: POST
path: "/oid4vci/api/nonce"
tags: ["Issuer OID4VCI API"]
---

# Provide a self-contained nonce in a publicly accessible endpoint.

`POST /oid4vci/api/nonce`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/oid4vci/api/nonce`
- Auth: none declared

Provide nonces for proof of possessions in a manner not requiring the service to save it.
The nonce should be used only once. The nonce has a (very) limit lifetime.
The response should not be cached.
For more information see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#section-7.2">OID4VCI Nonce Endpoint specification</a></br>
Also provides a DPoP nonce. For more details towards demonstrating proof of possession refer to <a href="https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid">RFC9449</a>

## Response `200`

OK

- NonceResponse
  - `c_nonce` string, required: String containing an unpredictable challenge to be used when creating a proof of possession of the key.

## Other responses

- `405`: HTTP method not allowed
- `500`: Internal Server Error

## Changes

- **2026-09-16** `5f1ad9f9b9c2`: 2 info
  - added the non-success response with the status `405`
  - added the non-success response with the status `500`
- **2026-07-10** `e6c8c61b58bc`: 1 breaking, 1 info
  - removed the media type `*/*` for the response with the status `200`
  - added the media type `application/json` for the response with the status `200`
- **2026-05-26** `beb3cc8fa8bf`: 1 info
  - removed the non-success response with the status `404`
- **2025-07-14** `5a2a7c30ac7c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/swiyu/apis/issuer-service-api/changes/oid4vci/api/nonce/post.md)

---

[API](https://skmtc.dev/swiyu/apis/issuer-service-api.md) - [All operations](https://skmtc.dev/swiyu/apis/issuer-service-api/llms.txt) - [OpenAPI document](https://skmtc.dev/swiyu/apis/issuer-service-api/revisions/f2f3fbbaf461?raw)