---
id: ext-payment-credential-issuance
title: "Payment Credential Issuance (TS12)"
description: "Issue SCA Attestations representing a payment account, card or user to the customer's EUDI Wallet."
hide_title: false
sidebar_label: Payment Credential Issuance
keywords: [Payment Credential, SCA Attestation, ASPSP, issuance, OpenID4VCI, PSD2, EUDI Wallet, TS12, Organisation Wallet, European Business Wallet]
slug: /extensions/payment-credential-issuance
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import NoteBox from '@site/src/components/NoteBox';
import ApiEndpoints from '@site/src/components/ApiEndpoint';

The Payment Credential Issuance extension enables an Account Servicing Payment Service Provider (ASPSP) to issue SCA Attestations to its customers' EUDI Wallets. The issued attestation represents a payment account, a card, or the authenticated user, and is later used to authorise payments or grant account access as defined in the [TS12 Electronic Payments SCA Implementation with Wallet](https://github.com/eu-digital-identity-wallet/eudi-doc-standards-and-technical-specifications/blob/main/docs/technical-specifications/ts12-electronic-payments-SCA-implementation-with-wallet.md) specification.

## How it works

1. The organisation enables the Payment Credential Issuance extension from the dashboard.
2. An administrator selects which SCA Attestation types to issue and configures the attributes included in each type.
3. When a customer requests a payment credential, an OpenID4VCI credential offer is generated by the issuer.
4. The customer accepts the offer in their EUDI Wallet, authenticates with the bank, and the wallet completes the authorisation code flow.
5. The system issues the SCA Attestation as an SD-JWT VC with a key binding to the wallet, ready to be used for SCA.

## Configuration

### SCA Attestation types

Select which attestation types the issuer will offer:

| Attestation | Description | Key attributes |
|---|---|---|
| **Account attestation** | Represents a payment account | `iban`, `bic`, `currency`, `account_holder_name` |
| **Card attestation** | Represents a payment card | `scheme`, `pan_last_four`, `expiry` |
| **User attestation** | Represents the authenticated user only | `given_name`, `family_name`, user identifier |

Common attributes on every SCA Attestation include the issuer and audience identifiers, the validity period (`iat`, `nbf`, `exp`), the credential type identifier (`vct`), and the key binding (`cnf`) to the wallet.

### Issuance settings

| Setting | Description |
|---|---|
| **Credential format** | `vc+sd-jwt` (SD-JWT VC) |
| **Validity period** | Lifetime of the issued attestation |
| **Issuance flow** | Authorization Code flow (OpenID4VCI) |
| **Batch issuance** | Whether multiple attestations are issued in a single request |

### Integration

Once configured, the system exposes the standard OpenID4VCI endpoints for discovery and issuance of SCA Attestations.

**API endpoints:**

<ApiEndpoints endpoints={[
  { method: 'get', path: '/v3/config/extension/payment-issuance', description: 'Retrieve current configuration' },
  { method: 'put', path: '/v3/config/extension/payment-issuance', description: 'Update issuance settings' },
]} />

<NoteBox title="Caution:" variant="caution">
Disabling the Payment Credential Issuance extension deletes its configuration. Previously issued attestations remain valid until their expiry but cannot be refreshed from this issuer. This action is not reversible.
</NoteBox>