OpenID for Verifiable Credentials (OID4VC)

Defines a standard OAuth 2.0-based flow for a Wallet to securely request and receive one or more Verifiable Credentials from an Issuer. The protocol supports both authorization code and pre-authorized code grant types, allowing for flexible integration scenarios. A key feature is Credential Offer, a QR code or deep link initiated by the Issuer that triggers the flow, containing the issuer's endpoint and the types of credentials available. This mechanism ensures interoperability between any compliant wallet and issuer, eliminating vendor lock-in.

Standardizes how a Wallet presents Verifiable Credentials to a Verifier (Relying Party) using a Presentation Exchange request. The Verifier defines the required credentials and attributes in a declarative JSON format. The protocol supports three response modes: same-device (e.g., a mobile browser redirect), cross-device (e.g., scanning a QR code on a desktop with a mobile wallet), and W3C Digital Credentials API integration. This ensures a unified user experience across web, mobile, and native applications.

Self-Issued OpenID Provider v2 (SIOPv2) is a foundational extension that allows an end-user to act as their own identity provider. Instead of authenticating against a centralized server, the user authenticates directly with a Decentralized Identifier (DID) controlled by their wallet. This is a critical component for Self-Sovereign Identity (SSI) architectures, enabling user-centric authentication without federated intermediaries. SIOPv2 supports multiple subject syntax types, including did:key, did:web, and did:indy.

The OpenID High Assurance Interoperability Profile (HAIP) provides a concrete, implementer-focused profile of OID4VC and SIOPv2 for high-security use cases. It mandates specific cryptographic algorithms, such as ES256 and EdDSA, and removes optionality to guarantee interoperability. HAIP is designed to meet the stringent requirements of regulated industries and government identity schemes, including the EU Digital Identity Wallet (eIDAS 2.0) architecture.

An extension of OpenID Connect that enables an end-user to act as their own identity provider using a Decentralized Identifier (DID). Unlike traditional OIDC flows that redirect to a centralized provider like Google, SIOPv2 allows the wallet to authenticate directly with the relying party via DIDComm or standard OAuth 2.0 channels.

• Eliminates the need for a third-party identity provider
• Uses DID Authentication to prove control of a cryptographic identifier
• Forms the authentication layer that OID4VC builds upon for credential presentation

A declarative JSON-based query language that verifiers use to describe the exact credentials and claims they require from a holder. Rather than asking for entire documents, a verifier defines a Presentation Definition specifying which fields from which credential types must be revealed.

• Enables selective disclosure by requesting only necessary claims
• Supports complex logic: all, pick, and count rules across multiple credentials
• Works with OID4VP to transport the presentation request and response

A W3C-standard tamper-evident digital credential that cryptographically proves claims about a subject. OID4VC specifies the transport layer for issuing and presenting VCs, while the VC data model defines the credential structure itself.

• Contains issuer signature, credential subject claims, and proof metadata
• Supports JSON-LD and JWT encoding formats
• Enables cryptographic verification without contacting the issuer in real-time

A globally unique, persistent identifier that requires no centralized registration authority. In OID4VC flows, DIDs identify issuers, holders, and verifiers without relying on traditional DNS-based identity providers.

• Resolves to a DID Document containing public keys and service endpoints
• Supports multiple methods: did:web, did:key, did:indy, did:ebsi
• Provides the cryptographic root of trust for verifying VC signatures

The ability of a credential holder to reveal only specific attributes from a verifiable credential without exposing the entire document. OID4VC enables this through SD-JWT (Selective Disclosure JWT) and BBS+ signatures.

• A user can prove they are over 21 without revealing their exact birthdate
• Prevents unnecessary data leakage during verification
• Uses cryptographic blinding and hash commitments rather than simple field redaction

A secure application that stores a user's verifiable credentials and cryptographic keys, acting as the holder endpoint in OID4VC flows. Regulatory frameworks like eIDAS 2.0 mandate these wallets for European Digital Identity implementation.

• Handles OID4VCI issuance requests and OID4VP presentation responses
• Manages consent for each credential share operation
• Must comply with ISO 18013-5 for mobile driver's license integration