Credential Offer parameter values treated as not trustworthy

OID4VCI 1.0 §13.5MUSTRoles: wallet

Requirement as recorded in the ProtocolSoup registry

The Wallet MUST treat Credential Offer parameter values as not trustworthy and MUST perform the same Issuer validation as for a Wallet-initiated flow.

Read §13.5 in OID4VCI 1.0

Self-test verdict

PassCommit 97df6a8Evaluated 2026-10-11

This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.

Tests

TestMetadataCredentialIssuerMismatchRejection
./cmd/walletharness
Pass

Implementation

backend/cmd/walletharness/oid4vci_external.go

Related requirements

CW-024Metadata not used when credential_issuer mismatches the identifier CW-089Fresh Access Token via Refresh Token to refresh Credentials

All OID4VCI 1.0 requirements · OID4VCI protocol page