How Credential Verification Works in EUDI Wallets (OpenID4VP)

--- id: openid4vp-credential-verification title: "Credential Verification for EUDI Wallets (OpenID4VP)" hide_title: false description: "OpenID4VP (OID4VP) is the protocol EUDI wallet verifiers use to request and validate verifiable presentations. Learn the presentation request, VP token response and verification flow, with examples." sidebar_label: Credential Verification (OpenID4VP) keywords: [OpenID4VP, OID4VP, OpenID4VC, verifiable presentation, VP token, presentation definition, DCQL, credential verification, verifier, relying party, EUDI Wallet, European Business Wallet, verifiable credentials, ARF, iGrant.io] slug: /openid4vp-credential-verification/ --- > **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration: > > ```bash > npx skills add L3-iGrant/skills > ``` How Credential Verification Works in EUDI Wallets (OpenID4VP) _OpenID4VP (also written OID4VP) is the protocol a verifier uses to request verifiable credentials from an EUDI Wallet or European Business Wallet and validate what comes back. This page explains where it sits in the OpenID4VC family, the four-step verifier flow, how the verifier states its requirements with a Presentation Definition or DCQL query, and what it checks before trusting a presentation._ ## What OpenID4VP is OpenID for Verifiable Presentations (OpenID4VP) is the protocol a verifier, also called a Relying Party, uses to request credentials from a holder's wallet and validate the presentation returned. It is one of the three specifications in the [OpenID for Verifiable Credentials (OpenID4VC)](/concepts/openID4vc/) family, and it is the presentation counterpart to [OpenID4VCI credential issuance](/concepts/openid4vci-credential-issuance/). Like the rest of the family, OpenID4VP builds on OAuth 2.0 and OpenID Connect patterns. The EUDI Wallet Architecture and Reference Framework (ARF) references OpenID4VP as the protocol for presenting Person Identification Data (PID) and attestations to verifiers. ## The verification flow Verification follows four steps. The iGrant.io Organisation Wallet Suite dashboard shows this same sequence as the verification workflow status for each request. 1. **Create presentation request.** The verifier (Relying Party) creates an Authorization Request specifying the required credentials via a Presentation Definition or a DCQL query. 2. **Deliver request to wallet.** The request reaches the holder's wallet via a QR code, a deep link, or direct post. The wallet receives and parses the Authorization Request. 3. **Receive authorization response.** The wallet submits an Authorization Response containing the VP token, with the verifiable presentation or presentations, to the verifier's response endpoint. 4. **Verify and process presentation.** The verifier validates the VP token by checking signatures, credential status, and conformance to the presentation request, then acknowledges receipt. ## Presentation Definition and DCQL The verifier states which credentials and claims it needs in the presentation request. There are two ways to express that requirement: - **Presentation Definition:** the Presentation Exchange format used in earlier OpenID4VP drafts. - **DCQL (Digital Credential Query Language):** the JSON query language introduced in OpenID4VP 1.0 and preferred for new EUDI wallet deployments. See the [DCQL overview](/docs/dcql-overview/) and the [DCQL concepts article](/concepts/eudi-wallet-dcql-openid4vp-business-wallet-payments/), and try the [live DCQL demos](https://igrant.io/demo.html?filter=tech-dcql). Either way, the wallet uses the requirement to select matching credentials and to drive selective disclosure, so the holder shares only the claims the verifier asked for. ## What the verifier checks Before trusting a presentation, the verifier validates the VP token on three points: - **Signatures:** the issuer signature on each credential and the holder's proof of possession. - **Credential status:** whether the credential is still valid, for example checking revocation against a status list or registry. - **Conformance:** that the returned presentation matches the credentials and claims the verifier requested. Once these pass, the verifier accepts the presentation and acknowledges receipt. ## Related - [OpenID4VC: OpenID4VCI, OpenID4VP and SIOPv2 explained](/concepts/openID4vc/) - [OpenID4VCI credential issuance](/concepts/openid4vci-credential-issuance/) - [DCQL overview](/docs/dcql-overview/) - [Send and verify credentials with OpenID4VP (API guide)](/docs/openID4vc-send-verify-credentials/) ## Frequently asked questions ### What is OpenID4VP? OpenID for Verifiable Presentations (OpenID4VP, also written OID4VP) is the OpenID4VC protocol a verifier uses to request verifiable credentials from a holder's wallet and validate the presentation that comes back. It is the presentation counterpart to OpenID4VCI and is referenced by the EUDI Wallet Architecture and Reference Framework (ARF). ### What is a VP token? A VP token (vp_token) is the value the wallet returns in the Authorization Response. It carries one or more verifiable presentations that satisfy the verifier's request, which the verifier then checks cryptographically. ### What is the difference between a Presentation Definition and a DCQL query? Both let a verifier state which credentials and claims it needs. Presentation Exchange definitions were used in earlier drafts, while DCQL (Digital Credential Query Language) is the JSON query language introduced in OpenID4VP 1.0 and preferred for new EUDI wallet deployments. ### What does the verifier check when validating a presentation? The verifier validates the VP token by checking the issuer and holder signatures, the credential status such as revocation, and that the presentation conforms to the request it sent. It then acknowledges receipt.