FAPI 2.0 compliance including PKCE S256, PAR and iss

Requirement as recorded in the ProtocolSoup registry

When implementing OpenID for Verifiable Credential Issuance, both the Wallet and the Credential Issuer MUST comply with the provisions of the FAPI 2.0 Security Profile that are applicable, including PKCE with S256, PAR where applicable, and the iss value in the Authorization Response.

Self-test verdict

Tests

• TestPKCES256ChallengeGeneration

  ./cmd/walletharness

  Pass
• TestPARFormIncludesCodeChallengeMethodS256

  ./cmd/walletharness

  Pass
• TestRFC9207IssMismatchRejection

  ./cmd/walletharness

  Pass

Implementation

• backend/cmd/walletharness/oid4vci_client.go
• backend/cmd/walletharness/oid4vci_external.go

Related requirements