OpenID4VP

OpenID for Verifiable Presentations with DCQL-first request contracts

Start with Recommended FlowRecommended Flow Open Looking Glass

Available Flows

OID4VP DCQL + direct_post

Verifier creates a signed authorization request object with DCQL query and publishes a request_uri. Wallet fetches the request, evaluates the query, and posts vp_token to response_uri using direct_post (OID4VP §5, §8.2).

DCQL Querydirect_postVerifier Policy

View flow diagram

OID4VP DCQL + direct_post.jwt

Verifier creates a signed authorization request and publishes request_uri. Wallet fetches it, creates an encrypted JWE response containing a signed inner JWT (typ=oauth-authz-resp+jwt) with vp_token, and posts to response_uri. Verifier decrypts and validates (OID4VP §5, §8.3.1).

Encrypted Responsedirect_post.jwtNonce + State

View flow diagram

Specs & references

Authoritative reading list for OpenID4VP — core specs, security considerations, and companion standards.

Core specs

· The specifications that define this protocol.

OpenID for Verifiable Presentations 1.0

Security & privacy

· Dedicated security and privacy considerations.

Companion specs

· Extensions, hardenings, and supporting RFCs.

Deployment profiles

· Profiles that constrain the protocol for specific assurance regimes.

OpenID4VC High Assurance Interoperability Profile (HAIP)

OpenID4VP

Available Flows

OID4VP DCQL + direct_post

OID4VP DCQL + direct_post.jwt

Specs & references

Core specs

Security & privacy

Companion specs

Deployment profiles

OpenID4VP Features

DCQL-first Requests

Request Object (JAR)

direct_post Transport