Nonce endpoint issues a fresh c_nonce without authorization

OID4VCI 1.0 §7MUSTRoles: issuer

Requirement as recorded in the ProtocolSoup registry

The Nonce Endpoint MUST issue a fresh c_nonce without requiring an access token or other authorization.

Read §7 in OID4VCI 1.0

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestNonceEndpointIsPublicWithIrrelevantAuthHeaders
./internal/protocols/oid4vci
Pass

Implementation

backend/internal/protocols/oid4vci/handlers.go

Related requirements

Also in §7

CI-009Nonce endpoint offered when c_nonce is required in proofs

CI-009Nonce endpoint offered when c_nonce is required in proofs CI-005Single proof type with a non-empty array in proofs

All OID4VCI 1.0 requirements · OID4VCI protocol page