PID Credential Issuance
The PID Credential Issuance extension enables a government-sanctioned PID provider to issue Person Identification Data (PID) credentials to customers' EUDI Wallets. The credential is issued at high level of assurance and follows EWC RFC003 - Issue Person Identification Data for the issuance flow and the PID Rulebook, version 1.7 (ARF Annex 3.01) for the attributes.
How it works
- The organisation enables the PID Credential Issuance extension from the dashboard.
- An administrator configures the source of identity data (authentic source / civil registry), the attributes to include, and the wallet conformity rules.
- When a customer requests a PID, an OpenID4VCI credential offer is generated (Authorization Code or Pre-Authorized Code flow).
- The customer accepts the offer in their EUDI Wallet, authenticates at the PID provider, and the wallet submits a Wallet Unit Attestation (WUA) and a proof-of-possession JWT.
- The system verifies wallet conformity and authenticity, then issues the PID credential cryptographically bound to the wallet key (in-time or deferred).
Signing key: When you enable the extension, choose its signing key on the extension page, or send `signingKeyId` through the API: an X.509 key with a certificate chain, which all definitions of the extension sign with. Until it has a key, the extension waits in the status `awaitingKey` and does not run.
Configuration
Issuance flow
Choose the OpenID4VCI flow the issuer will support:
| Flow | Description |
|---|---|
| Authorization Code | Traditional OAuth flow with user authentication at the PID provider |
| Pre-Authorized Code | Issuer provides a pre-authorised code with an optional transaction code (PIN delivered out-of-band) |
Credential attributes
Select which attributes to include in the issued PID:
| Attribute group | Examples |
|---|---|
| Mandatory | family_name, given_name, birthdate, place_of_birth (at least one of country, region, locality), nationalities, picture (empty when the user opts out) |
| Mandatory metadata | issuing_authority, issuing_country |
| Optional | address (formatted, street address, house number, locality, region, postal code, country), birth_family_name, birth_given_name, sex, email, phone_number, personal_administrative_number |
| Optional metadata | date_of_expiry, date_of_issuance, document_number, issuing_jurisdiction, trust_anchor, attestation_legal_category, credential status reference |
The PID does not include age attributes. To check the holder's age, derive it from birthdate or use the Age Verification credential instead.
Issuance settings
| Setting | Description |
|---|---|
| Credential formats | dc+sd-jwt and/or mso_mdoc (ISO/IEC 18013-5) |
| Validity period | Lifetime of the issued PID |
| Wallet conformity | CAB certificate validation before issuance |
| Authentic source | Connection to the civil registry or equivalent data source |
Integration
Once configured, the system exposes the standard OpenID4VCI endpoints for discovery and issuance.
API endpoints:
- GET
/v4/config/platform/extension/pid-issuance- Retrieve current configuration
Caution: Disabling the PID Credential Issuance extension deletes its configuration. Previously issued PIDs remain valid until their expiry but cannot be refreshed from this issuer. This action is not reversible.