OpenID4VCI

OpenID for Verifiable Credential Issuance with multi-format VC support

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

OID4VCI Pre-Authorized Code

Wallet resolves a credential offer URI, discovers issuer metadata, exchanges a pre-authorized code for an access token with c_nonce, and requests a Verifiable Credential bound to a proof JWT.

Pre-Authorized CodeProof JWTc_nonce Binding

View flow diagram

OID4VCI Pre-Authorized Code + tx_code

Pre-authorized credential issuance with mandatory transaction code enforcement at token exchange — the offer's grant block declares a tx_code object requiring wallet to include a user-entered code (OID4VCI §6.1).

tx_code RequiredPre-Authorized FlowNonce Freshness

View flow diagram

OID4VCI Deferred Credential Issuance

Full pre-authorized code flow where the credential endpoint returns a transaction_id for deferred issuance — wallet polls the deferred_credential endpoint until the credential is ready (OID4VCI §9).

Deferred Pollingtransaction_idIssued Credential

View flow diagram

Specs & references

Authoritative reading list for OpenID4VCI — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

OpenID for Verifiable Credential Issuance 1.0

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.

Deployment profiles

· Profiles that constrain the protocol for specific assurance regimes.

OpenID4VC High Assurance Interoperability Profile (HAIP)
Required-feature profile for eIDAS 2 and similar high-assurance regimes.

OpenID4VCI

Available Flows

OID4VCI Pre-Authorized Code

OID4VCI Pre-Authorized Code + tx_code

OID4VCI Deferred Credential Issuance

Specs & references

Core specs

Security & privacy

Companion specs

Deployment profiles

OpenID4VCI Features

Credential Offer (by value/reference)

Pre-Authorized Code Grant

tx_code Enforcement