Skip to main content

Credential Issuance for EUDI Wallets (OpenID4VCI)

OpenID4VCI (also written OID4VCI or OIDC4VCI) is the protocol an issuer uses to deliver a verifiable credential into an EUDI Wallet or European Business Wallet. This page explains where it sits in the OpenID4VC family, the five-step issuance flow, the authorization code and pre-authorized code grant types, and the credential formats it carries.

What OpenID4VCI is​

OpenID for Verifiable Credential Issuance (OpenID4VCI) is the protocol an issuer uses to deliver a verifiable credential into a holder's wallet. It is one of the three specifications in the OpenID for Verifiable Credentials (OpenID4VC) family, alongside OpenID4VP for presentation and SIOPv2 for self-issued authentication.

OpenID4VCI builds on OAuth 2.0, so issuers reuse familiar authorization and token endpoints rather than inventing new ones. The EUDI Wallet Architecture and Reference Framework (ARF) references OpenID4VCI as the issuance protocol for Person Identification Data (PID) and attestations, which makes it the default way credentials reach an EUDI Wallet or a European Business Wallet.

The issuance flow​

Issuance follows five steps. The iGrant.io Organisation Wallet Suite dashboard shows this same sequence as the issuance workflow status for each credential.

  1. Create credential offer. The issuer creates a Credential Offer specifying the credential type, format, and grant type (Authorization Code or Pre-Authorized Code).
  2. Deliver offer to wallet. The offer reaches the holder's wallet via a QR code, a deep link, or the Credential Offer endpoint. The wallet then resolves the issuer metadata from the issuer's /.well-known/openid-credential-issuer document.
  3. Authorize and issue token. The wallet authenticates and exchanges the authorization grant for an access token at the issuer's token endpoint.
  4. Issue credential. The wallet sends a Credential Request with proof of key possession. The issuer signs and returns the credential, or a transaction ID for deferred issuance.
  5. Acknowledgement. The wallet confirms receipt through the Notification endpoint, and the issuance status moves to credential acknowledged.

Authorization Code and Pre-Authorized Code flows​

OpenID4VCI defines two grant types, chosen when the credential offer is created.

  • Authorization Code flow. The wallet redirects the holder to the issuer to authenticate and consent before the credential is issued. Use it when the issuer needs to identify the holder at issuance time, for example a bank issuing an account credential.
  • Pre-Authorized Code flow. The holder has already been identified out of band, so the offer carries a pre-authorized code. The wallet exchanges that code, optionally with a transaction PIN, for an access token and receives the credential without a separate login. Use it when identification already happened in another channel, for example a portal that has just verified the user.

Both grant types converge on the same credential request and delivery steps described above.

Credential formats​

OpenID4VCI is format agnostic; the format is named in the credential offer and in the issuer metadata. EUDI wallet deployments most often use:

  • IETF SD-JWT VC: a selective-disclosure JSON credential, so the holder can later reveal only the claims a verifier needs.
  • ISO/IEC 18013-5 mdoc (mDL): the mobile document format used for driving licences and government IDs.

W3C Verifiable Credentials are also supported. Once stored, the credential can be presented to a verifier using OpenID4VP credential verification.

Frequently asked questions​

What is OpenID4VCI?​

OpenID for Verifiable Credential Issuance (OpenID4VCI, also written OID4VCI or OIDC4VCI) is the OpenID4VC protocol that defines how an issuer delivers a verifiable credential to a holder's wallet. It builds on OAuth 2.0 and is the issuance protocol referenced by the EUDI Wallet Architecture and Reference Framework (ARF).

Is OID4VCI the same as OIDC4VCI?​

Yes. OID4VCI, OIDC4VCI and oid4vc are informal spellings of the same OpenID for Verifiable Credential Issuance specification. The name used by the OpenID Foundation today is OpenID4VCI.

What is the difference between the authorization code and pre-authorized code flows?​

In the authorization code flow the wallet sends the holder to the issuer to authenticate before a credential is issued. In the pre-authorized code flow the holder has already been identified out of band, so the wallet presents a pre-authorized code, optionally with a PIN, and receives the credential without a separate login step.

Which credential formats can OpenID4VCI issue?​

OpenID4VCI is format agnostic. In EUDI wallet deployments it is commonly used to issue IETF SD-JWT VC and ISO/IEC 18013-5 mdoc credentials, and it also supports W3C Verifiable Credentials.