OpenID for Verifiable Credential Issuance - OID4VCI

OpenID for Verifiable Credential Issuance is a protocol specification that defines a standardized API for issuing verifiable credentials. It enables credential issuers to provide digital credentials to wallet applications in a secure, interoperable way using OAuth 2.0 as the underlying authorization framework.

The protocol supports multiple credential formats including SD-JWT VC, ISO mDL, and W3C Verifiable Credentials. It defines how wallets can discover issuers' capabilities, request credentials, and receive them through standardized endpoints.

Key features include:

• Support for both issuer-initiated and wallet-initiated credential issuance flows
• Multiple authorization flows including Authorization Code Flow and Pre-Authorized Code Flow
• Cryptographic binding of credentials to holder keys
• Deferred credential issuance for scenarios requiring background processing
• Metadata discovery for issuer capabilities and credential types
• Proof of possession mechanisms for key material

Technical Details:

1. Purpose and Scope:

• Defines an OAuth 2.0-protected API for verifiable credential issuance
• Enables interoperable credential issuance across different credential formats
• Supports both synchronous and asynchronous credential delivery

2. Key Technical Specifications:

• Required endpoints:
  • credential_endpoint for issuing credentials
  • Optional nonce_endpoint for proof of possession
  • Optional deferred_credential_endpoint for delayed issuance
  • Optional notification_endpoint for status updates

3. Implementation Requirements:

• Must implement OAuth 2.0 authorization
• Must support TLS for all endpoints
• Must validate proof of possession for credential binding
• Must implement metadata discovery mechanisms

4. Security Considerations:

• Requires secure key management
• Implements replay prevention mechanisms
• Enforces access token validation
• Supports credential binding to prevent unauthorized use

5. Interoperability Features:

• Standardized metadata format
• Common credential request/response formats
• Support for multiple credential formats
• Extensible proof types

6. Current Status:

• Active specification under development by the OpenID Foundation
• Multiple implementations in progress
• Growing adoption in digital identity ecosystems

The standard represents a crucial building block for interoperable digital credential ecosystems, enabling secure and standardized credential issuance across different platforms and credential formats.