OpenID4VCI - Issue Credential (In-Time)
InTime issuance of credentials (or immediately) using OpenID for Verifiable Credentials Issuance (OID4VCI) involves two main stages: the creation of a credential definition and the in-time issuance of the credential.
Create Credential Definition: This involves the following sub-steps as illustrated:
- Define: Establish the parameters and rules for the credential.
- Prepare: Set up the necessary infrastructure and information for issuing the credential.
InTime Issue: The credentials are issued after either being authorised or pre-authorised (as indicated by the transaction code, Txn_Code). Before issuing, the holder's wallet endpoint must be configured.
The image illustrates this process, showing how the credential definition is linked to the in-time issuance mechanism. The flow moves from defining and preparing the credential to an authorised issuance step, where the credential can be configured and issued to the holder's wallet. Here are the steps to follow:
Step 1: Get the API Key (Issuer Admin)
To obtain your API key, please contact [email protected]. Once you have received your API key, enter it in the field below and click the Set API Key button to save it for future use.
x509 key of your organisation: a key with a certificate chain. After you set the API key, the page fills in such a key. If no key has a certificate, it fills in your default key with did:key, for tests only. To choose another key, click the key label next to a signing key field in a request, for example cryptographicKeyIdentifier. To create a key, attach a certificate or see your keys, follow the key management guide. To add your certificate to the NXD trust list, see trust list registration.Step 2: Create Credential Definition (Issuer Admin)
To create a credential definition, run the code block below using the Run button. Alternatively, you can manually copy the code block and use it in the body of the API request available here. From the API response, copy the credentialDefinitionId for use in Step 3. Credentials can be issued in any of the following formats:
Request
Response
Credential category: each entry of credentialDefinitions can have a credentialCategory: pid, eaa, qeaa, pub-eaa, or none (the default, no rule). With a category, the wallet checks that the certificate of the signing key of the entry fits the category, and refuses a key that does not fit with 400 and errorType signing_key_does_not_fit. An mDL (doctype org.iso.18013.5.1.mDL) needs a key with the ISO/IEC 18013-5 Document Signer profile, whatever its category. Each answer shows the result of the check in signingKeyCheck. When the category is none and the entry is a PID whose key fits, suggestedCredentialCategory is pid. For a QEAA and a PuB-EAA, the issuer adds the EAA category of ETSI TS 119 472-1 to each credential. For the categories, their certificate rules and the key usage types, see Credential Categories and Key Usage Types.
credentialDefinitionId can be reused to issue multiple credentials (Step 3).Step 3: Issue and Receive Credential (Issuer/Holder)
When you run Step 2 on this page, the credentialDefinitionId field below is autofilled automatically (and updated whenever Step 2 is re-run). If you are executing the APIs yourself, replace <credentialDefinitionId> with the ID obtained in Step 2. The issuer requests the issuance of a credential in InTime issuance mode: run the JSON code block below with the Run button. Choose the credential format as needed. Alternatively, you may use the API available here.
After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device, such as via a browser.
Request
Response
credential.claims for IETF SD-JWT VC, credential.claims with the mDoc namespace as the top key for ISO/IEC 18013-5 mdoc/mDL, and credential.credentialSubject.credentialSubject for W3C VC (JWT). The issuer sets type, vct and doctype from the credential definition. Without a validity in the credential definition, the credential is valid for the default of the issuer global configuration (180 days).Alternatively, you can manually copy the code block, update the placeholders, and use it in the body of the API request available here. From the response received, copy the credentialOffer and generate a QR code using a QR code generator tool, or paste the response into our tool here. The EUDI Wallet/Holder can then accept the credential offer using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device (e.g., in a browser).
Try It Yourself (With Demo Video)
Watch the below demo to learn issue credential API and try it out yourselves:
W3C VC JWT Credential Format
W3C VC JWT Credential Format Demo: Learn how to issue W3C Verifiable Credentials (JWT) using OpenID4VCI protocol with iGrant.io Digital Wallets.
ISO/IEC 18013-5 mdoc/mDL Credential Format
ISO/IEC 18013-5 mdoc/mDL Credential Format Demo: Learn how to issue ISO/IEC 18013-5 mdoc/mDL credentials using OpenID4VCI protocol with iGrant.io Digital Wallets.
IETF SD-JWT Credential Format
Will be published soon