| title | description |
|---|---|
Introduction |
OpenID for Verifiable Credentials |
This software has a client and issuer package to request and receive Verifiable Credentials using the OpenID for Verifiable Credential Issuance ( OpenID4VCI) specification for receiving Verifiable Credentials as a holder/subject. In addition the monorepo contains a package for requesting the presentation of Verifiable Credentials and Verifying these presentations OpenID for Verifiable Presentations ( OpenID4VP)
OpenID4VCI defines an API designated as Credential Endpoint that is used to issue verifiable credentials and corresponding OAuth 2.0 based authorization mechanisms (see [RFC6749]) that a Wallet uses to obtain authorization to receive verifiable credentials. W3C formats as well as other Credential formats are supported. This allows existing OAuth 2.0 deployments and OpenID Connect OPs (see [OpenID.Core]) to extend their service and become Credential Issuers. It also allows new applications built using Verifiable Credentials to utilize OAuth 2.0 as an integration and interoperability layer. This package provides holder/wallet support to interact with OpenID4VCI capable Issuer systems.
In addition to the client and issuer, there is also a common package, which has all the types and payloads shared between the client and issuer.
The OpenID4VCI client is typically used in wallet type of applications, where the user is receiving the credential(s). More info can be found in the client README
The OpenID4VCI issuer is used in issuer type applications, where an organization is issuing the credential(s). More info can be found in the issuer README. Please note that the Issuer is a library. It has some examples on how to run it with REST endpoints. If you are however looking for a full solution we suggest our SSI SDK or the demo
The SIOP-OpenID4VP package is used in wallet type applications and verifier type of applications. Meaning it provides both Wallet (OpenId Provider) and Verifier (Relying Party) functionality. More info can be found in the siop-oid4vp package README
The spec lists 2 flows:
This flow is supported but might need more work, so you might run into issues trying to use it.
The pre-authorized code flow assumes that the user is using an out of bound mechanism outside the issuance flow to authenticate first.
The below diagram shows the steps involved in the pre-authorized code flow. Note that inner wallet functionalities (like
saving VCs) are out of scope for this library.
Visit the README for more information.