Verify Credentials with OpenID4VP: API Guide & Code Examples

--- id: openID4vc-send-verify-credentials title: "Verify Credentials with OpenID4VP" hide_title: true sidebar_label: Send and Verify Credential slug: /openID4vc-send-verify-credentials/ description: "Step-by-step OpenID4VP verification: get an API key, build a presentation definition, generate the QR request, and validate the returned presentation, with code." keywords: [OpenID4VP, credential verification, OID4VP, verifiable credentials, presentation definition, DCQL, relying party, verifier, Organisation Wallet, European Business Wallet, EUDI Wallet, API, send credentials] --- > **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration: > > ```bash > npx skills add L3-iGrant/skills > ``` import Link from "@docusaurus/Link"; import VideoPlayer from "@site/src/components/VideoPlayer"; import NoteBox from "@site/src/components/NoteBox"; Verify Credentials with OpenID4VP: API Guide & Code Examples # Verify Credentials with OpenID4VP In the realm of digital identity, verifiers, also known as Relying Parties (RP), play a crucial role in validating the authenticity of presented credentials. Utilising the OpenID for Verifiable Presentations (OpenID4VP) protocol, verifiers can request, receive, and assess verifiable credentials in a secure and standardised manner. This guide outlines the process for verifiers to follow: - Define the specific credentials or claims they require through a presentation definition. - Initiate a verification request to holders, often facilitated via QR codes or direct links. - Receive and validate the verifiable presentation returned by the holder's wallet, ensuring the data's integrity and authenticity. By following the steps below, verifiers can request digital credentials and verify them, fostering trust in digital interactions. ### Step 1: Get the API Key To obtain your API key, please contact [support@igrant.io](mailto:support@igrant.io?subject=Request%20API%20Key). Once you have received your API key, enter it in the field below and click the **Set API Key** button to save it for future use. import { ApiKeyManager } from "@site/src/components/ApiKeyManager"; ### Step 2: Create Presentation Definition (Verifier Admin) To create a presentation definition for requesting proof, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request provided [here](/docs/openid4vc-api/config-digital-wallet-open-id-presentation-definition). import Step2 from "@site/src/components/Verification/Step2"; Once a presentation definition is created, the presentationDefinitionId can be reused to verify multiple credentials (Step 3). ### Step 3: Create Verification Request (Verfier/Relying Party) To create the verification request, execute the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-verification-request-v-3). After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the verification request on their mobile device, such as via a browser. import Step3 from "@site/src/components/Verification/Step3"; ", requestByReference: true, }} /> The presentation definition provided adheres to the specifications outlined in the DIF Presentation Exchange standard, as detailed [here](https://identity.foundation/presentation-exchange/). :::tip Building queries with DCQL instead? OpenID4VP 1.0 introduces the **Digital Credential Query Language (DCQL)** as the modern successor to DIF Presentation Exchange. Start with the [DCQL overview](/docs/dcql-overview/), then work through a runnable, step-by-step tutorial for your scenario: - [Trusted Authorities](/docs/dcql-basic-credential-query-with-trusted-authority/) - restrict a credential to trusted issuers - [Claim Sets (Selective Disclosure)](/docs/dcql-2-4-2-claim-set-age-verification/) - age verification with minimal disclosure - [Credential Sets (Alternatives)](/docs/dcql-2-4-3-credential-set-proof-of-identity-alternatives/) - accept any one of several identity credentials - [Combined Credential Sets](/docs/dcql-2-4-4-kyc-request-photo-id-address-proof/) - KYC with Photo ID plus address proof - [Mandatory and Optional Sets](/docs/dcql-2-4-5-student-transport-pass/) - student transport pass with optional extras - [Multiple Credential Instances](/docs/dcql-2-4-6-loan-application-multiple-bank-statements/) - request several recent bank statements - [Values Constraint](/docs/dcql-2-4-7-delivery-service-restricted-postal-codes/) - accept a credential only for allowed postal codes ::: ### Step 4: Send and Receive Verifiable Presentation (Holder) The holder wallet accepts (consents) to send the requested credentials. ### Step 5: Send and Receive Verifiable Presentation (Verifier/Relying Party) * The Verfier (Relying Party) receives the requested credentials and can verify it. They may read the received credential by executing the [Read Verification History API](/docs/openid4vc-api/config-read-digital-wallet-open-id-verification-history-v-3). * From the response received, the `vpTokenResponse` can be decoded using [JWT Decoder](/docs/devtools-jwt-decoder/). * From decoded response, the `verifiableCredential` inside the 'vp' can be further decoded to view the received credentials. :::info Trust status of the verifier The wallet checks whether the verifier can be matched against a recognised trust list. The verification response exposes this through the `isVerifiedWithTrustList` and `trustServiceProvider` fields. If the verifier cannot be matched, the Data Wallet shows a **"Service provider not verified"** warning. See [The "Service provider not verified" notice](/docs/trust-untrusted-service-provider/) and [Trust in the Wallet Ecosystem](/docs/trust-overview/). ::: ## Try It Yourself (With Demo Video) Watch the below demo to learn verify credential API and try it out yourselves: