Issue payment wallet attestations with OpenID4VCI

--- id: openID4vci-payment-wallet-attestation title: Payment Authenticator hide_title: false description: Follow the steps to issue verifiable payment wallet attestations using OpenID4VCI, enabling secure and trusted payment authentication workflows. sidebar_label: Payment Authenticator keywords: [payment authenticator, payment wallet attestation, OpenID4VCI, Organisation Wallet, European Business Wallet, EUDI Wallet, PSD2, payment authentication] slug: /openID4vci-payment-wallet-attestation/ --- > **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration: > > ```bash > npx skills add L3-iGrant/skills > ``` Issue payment wallet attestations with OpenID4VCI | iGrant.io DevDocs import Link from '@docusaurus/Link'; import VideoPlayer from '@site/src/components/VideoPlayer'; import NoteBox from '@site/src/components/NoteBox'; This workflow implements [European Wallet Consortium (EWC) RFC007](https://github.com/EWC-consortium/eudi-wallet-rfcs/blob/main/payment-rfcs/ewc-rfc007-payment-wallet-attestation.md), as specified by the [EWC Payment Task Force](https://github.com/EWC-consortium/eudi-wallet-rfcs/blob/main/payment-rfcs/images/EWC-EUDI-Wallet-PaymentTaskForce.png). It uses the [OpenID4VCI Dynamic Credential Request](/docs/eo-ow-issue-dynamic-credential-request.mdx) protocol to issue a Payment Authenticator by authenticating the user with an identity document (e.g., PID, Passport, etc.). The following steps outline the process using OpenID4VCI as illustrated below: ![Issue Payment Authenticator - PWA](./images/ow-issue-payment-wallet-attestation-with-individual.png) ### Step 1: Get the API Key (Bank Issuer Admin) To obtain your API key, please contact [support@igrant.io](mailto:support@igrant.io?subject=Request%20API%20Key). Once you have received your API key, enter it in the field below and click the **Set API Key** button to save it for future use. import { ApiKeyManager } from '@site/src/components/ApiKeyManager'; ### Step 2: Create Webhook (Bank Issuer Admin) To create a webhook, you can run the code block below using the **Run** button. In the request payload, you must provide your webhook URL and a secret key: * **``**: This is the endpoint on your server that will receive real-time notifications about subscribed events, such as when a presentation is acknowledged (`openid.presentation.presentation_acked.v3`). * **``**: This is a secret key that you create. It is used to secure your webhook endpoint by allowing you to verify that incoming requests are genuinely from the iGrant.io platform. Alternatively, you can manually copy the code block and use it in the body of the API request available [here](/docs/openid4vc-api/config-create-webhook). import Step2 from '@site/src/components/PaymentWalletAttestationUsecase/Step2'; ", "disabled": false, "skipSslVerification": false, "subscribedEvents": { "consentManagementWebhook": [], "digitalWalletWebhook": [ "openid.presentation.presentation_acked.v3", "openid.credential.credential_acked" ] } } }} /> ### Step 3: Create Presentation Definition (Bank Issuer Admin) To create a presentation definition for requesting proof, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request provided [here](/docs/openid4vc-api/config-digital-wallet-open-id-presentation-definition). From the API response, copy the `presentationDefinitionId` for use in Step 5. In the example below, a national passport is used as the identification document. This can also be a EU Person Identification Data (PID) or any other similar identification as required by the Bank Issuer. import Step3 from '@site/src/components/PaymentWalletAttestationUsecase/Step3'; Once a presentation definition is created, the presentationDefinitionId can be reused to issue multiple credentials (Step 5). ### Step 4: Create Credential Definition (Bank Issuer Admin) To create a credential definition as per EWC RFC007, you can run the code block below using the **Run** button. Alternatively, you can manually copy the code block and use it in the body of the API request available [here](/docs/openid4vc-api/config-create-digital-wallet-open-id-credential-definition). From the API response, copy the `credentialDefinitionId` for use in Step 5. import Step4 from '@site/src/components/PaymentWalletAttestationUsecase/Step4'; ; Once a credential definition is created, the credentialDefinitionId can be reused to issue multiple credentials (Step 5). ### Step 5: Issue Credential (Bank Issuer) The Bank Issuer issues the Payment Authenticator in deferred mode after completing the necessary validations. Replace `` and `` with the actual IDs obtained in the previous steps. You can run the JSON code block below using the **Run** button. After receiving the response, toggle the button provided to dynamically generate a QR code. The EUDI Wallet/Holder can then accept the credential offer using the Data Wallet (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device, such as via a browser. import Step5 from '@site/src/components/PaymentWalletAttestationUsecase/Step5'; ', presentationDefinitionId: '', }} /> From the API response, copy the `credentialExchangeId` and the `credential.id` for use in Step 6. The `credential.id` corresponds to the `id` field from the `credentialDefinitions` array in the create credential definition response. **Note that the `credential.id` is not returned or required when using the DRAFT_11 credential format.** Alternatively, you can manually copy the code block, update the placeholders, and use it in the body of the API request available [here](/docs/openid4vc-api/config-digital-wallet-open-id-issue-credential/). From the response received, copy the `credentialOffer` and generate a QR code using a QR code generator tool, or paste the response into our tool [here](/docs/devtools-qrcode-generator/). The EUDI Wallet/Holder can then accept the credential offer using the [Data Wallet](https://igrant.io/datawallet.html) (or any other EU Digital Identity Wallet) by either scanning the QR code or directly accessing the credential offer on their mobile device (e.g., in a browser). Before scanning the QR code, ensure that the Holder Wallet has onboarded the user's identity credentials as required by banking guidelines, such as a national passport or Person Identification Data (PID). ### Step 6: Update Credential Offer (Bank Issuer) Upon receiving the `openid.presentation.presentation_acked.v3` webhook event and completing the requisite identity mapping in the bank backend, update the credential offer by running the code block below using the **Run** button. In the request payload, be sure to set the `credential.id` to the `id` value from the `credentialDefinitions` array in the create credential definition response. Alternatively, you can manually copy the code block, update the placeholders, and use the `credentialExchangeId` from the response as the path parameter in the API request available [here](/docs/openid4vc-api/config-update-digital-wallet-open-id-credential-history). import Step7 from '@site/src/components/PaymentWalletAttestationUsecase/Step7'; ; ### Try It Yourself (With Demo Video) Watch the below demo to learn Payment Authenticator issuance and try it out yourselves: