OpenID for Verifiable Credential Issuance introduces an OAuth 2.0-based API for issuing Verifiable Credentials (VCs) in formats like W3C, ISO mdoc, and SD-JWT VC

Summary of OpenID for Verifiable Credential Issuance (June 2025 Draft)

Introduction

The OpenID for Verifiable Credential Issuance draft introduces an OAuth 2.0-based API for issuing Verifiable Credentials (VCs) in formats like W3C, ISO mdoc, and SD-JWT VC. It enables secure claim assertion without direct issuer interaction, emphasizing security, privacy, and extensibility. Key authors include T. Lodderstedt, K. Yasuda, and T. Looker, with the specification under the OpenID Digital Credentials Workgroup.

Main Sections

Section 1: Framework and Core Concepts

Framework: Uses OpenID/OAuth for VC issuance, supporting multiple credential formats.
Key Concepts: Defines Base64url encoding, credential datasets, issuer-holder-verifier model, and holder binding methods (cryptographic, claims-based, biometric).
API Structure: Specifies endpoints (Credential Offer, Token, Metadata) and metadata requirements.

Section 2: Issuance Flows and Security

Authorization Code Flow: Issuer shares credentials via QR/URI; wallet retrieves metadata, obtains consent, and exchanges authorization code for token.
Pre-Authorized Code Flow: Issuer pre-authenticates user; wallet exchanges pre-authorized code for token (supports Transaction Codes for security).
Security Measures: Enforces TLS, replay attack prevention (via c_nonce), minimal disclosure, and user consent.

Section 3: Credential Offer and Endpoints

Credential Offer Endpoint: Supports transmission by value (direct JSON) or reference (URI). Requires credential_issuer and credential_configuration_ids.
Token Endpoint: Handles OAuth 2.0 token issuance, including pre-authorized_code grants and authorization_details.
Credential Endpoint: Issues VCs upon valid token submission, with optional encryption and cryptographic binding.

Section 4: Metadata and Compliance

Issuer Metadata: Includes required fields like credential_issuer, credential_endpoint, and credential_configurations_supported.
Client Metadata: Optional credential_offer_endpoint for custom URLs.
Compliance: Adheres to OAuth 2.0 (RFC 6749), JWT, and IANA standards, with extensibility for future proof types.

Section 5: Security and Privacy

Authentication: Wallets use attestations to verify issuers; issuers authenticate untrusted wallets.
Anti-Correlation: Minimizes unique IDs and sensitive data in requests.
Binding Methods: Prefers cryptographic binding, with alternatives like claims-based or bearer credentials for low-security use cases.

Section 6: Credential Formats

W3C Formats: Supports jwt_vc_json, jwt_vc_json-ld, and ldp_vc, each with specific encoding and metadata rules.
Other Formats: Includes ISO mdoc (mso_mdoc) and SD-JWT VC (dc+sd-jwt), ensuring cross-format interoperability.
Claims Handling: Processes claims sequentially, with strict path validation for JSON and mdoc.

Section 7: Use Cases and Deployment

Same-Device Issuance: Immediate delivery (e.g., digital diplomas).
Cross-Device Issuance: Deferred via QR codes (e.g., background checks).
Wallet-Initiated Flows: On-demand or post-installation requests.

Conclusion

The OpenID for Verifiable Credential Issuance draft provides a robust, OAuth 2.0-compatible framework for secure and flexible VC issuance. It balances standardization with extensibility, supporting diverse formats, workflows, and security requirements. Key revisions (e.g., Wallet Attestations, Nonce Endpoint) reflect ongoing improvements in interoperability and security. The specification is poised to enable widespread adoption of verifiable credentials across industries.