OpenID4VP

OpenID for Verifiable Presentations with DCQL-first request contracts

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

OID4VP DCQL + direct_post

Verifier creates a signed authorization request object with DCQL query and publishes a request_uri. Wallet fetches the request, evaluates the query, and posts vp_token to response_uri using direct_post (OID4VP §5, §8.2).

DCQL Querydirect_postVerifier Policy

View flow diagram

OID4VP DCQL + direct_post.jwt

Verifier creates a signed authorization request and publishes request_uri. Wallet fetches it, creates an encrypted JWE response containing a signed inner JWT (typ=oauth-authz-resp+jwt) with vp_token, and posts to response_uri. Verifier decrypts and validates (OID4VP §5, §8.3.1).

Encrypted Responsedirect_post.jwtNonce + State

View flow diagram

Specs & references

Authoritative reading list for OpenID4VP — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

OpenID for Verifiable Presentations 1.0

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.

Deployment profiles

· Profiles that constrain the protocol for specific assurance regimes.

OpenID4VC High Assurance Interoperability Profile (HAIP)

Normative requirements

Every MUST, SHOULD and MAY OpenID4VP exercises, with the section it comes from and ProtocolSoup's self-test verdict for this build.