PAR endpoint authentication matches Token Endpoint rules

HAIP 1.0 §4.3MUSTRoles: wallet

Requirement as recorded in the ProtocolSoup registry

Wallets MUST authenticate at the PAR endpoint using the same client authentication rules as at the Token Endpoint.

Read §4.3 in HAIP 1.0

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestPARFormIncludesCodeChallengeMethodS256
./cmd/walletharness
Pass
TestBuildAuthorizationURLFromPAR
./cmd/walletharness
Pass
TestShouldUseHAIPIssuancePathForExternalAttestedAS
./cmd/walletharness
Pass

Implementation

backend/cmd/walletharness/oid4vci_client.go

Related requirements

CW-H004Wallet supports DPoP and handles DPoP-Nonce from issuer endpoints CW-H013Wallet Attestation x5c, no reuse across Issuers, client_id equals sub

All HAIP 1.0 requirements · OID4VCI protocol page