OpenID for Verifiable Credentials (OpenID4VC)

Identity Protocol

A family of OpenID Foundation specifications that extends OAuth 2.0 and OpenID Connect to support the issuance, presentation, and verification of Verifiable Credentials. The family comprises three core specifications: OpenID for Verifiable Credential Issuance (OID4VCI) — defining how holders request and issuers issue VCs; OpenID for Verifiable Presentations (OID4VP) — defining how verifiers request and holders present VCs; and Self-Issued OpenID Provider v2 (SIOPv2) — enabling end-users to act as their own OpenID Provider. Together these specifications let any organization with existing OAuth infrastructure issue and verify W3C VCs, SD-JWT VCs, ISO/IEC 18013-5 mDocs, and other credential formats. Widely adopted by EU Digital Identity Wallet (EUDI) deployments and other large-scale identity programs .

Community
Links
Visit Community

Details

License N/A — specification documents, not source code; many open-source implementations exist (impierce/openid4vc Rust workspace, Sphereon SSI SDK, MATTR Pi Wallet SDK, and others) under various permissive licenses
Dev Status 🟢 Active
Dev Status Detail Released — OpenID4VCI 1.0 is a Final Specification (approved by OpenID Foundation membership September 2025; not subject to further revision); OID4VP and SIOPv2 are at Implementer's Draft or Working Group Draft stages and progressing toward Final
Owner OpenID Foundation (OIDF), via the Digital Credentials Protocols Working Group (DCP WG, which adopted the work from the OpenID Connect Working Group); specification editors include Torsten Lodderstedt, Kristina Yasuda, Tobias Looker, Oliver Terbu, and others
Country International (OpenID Foundation is a global standards body; editors and contributors from multiple countries and organizations including Sphereon, MATTR, Microsoft, and Spruce)
Start Year 2022
Stack N/A — specification, not implementation
Funding OpenID Foundation (member-funded standards body); EU Digital Identity Wallet program provides substantial implementation funding and ecosystem development
Last Investigated Jul 1, 2026

Use Case Domains

Identity & Trust

Identity Protocol Attributes

Origins OAuth 2.0 / OpenID Connect for Verifiable Credentials (designed to allow organizations with existing OAuth/OIDC infrastructure to issue and verify VCs without adopting a fundamentally new authorization framework; positioned as an interoperability bridge between traditional federated identity and SSI)
Database N/A — protocol specification; relies on whatever storage the issuer, holder, and verifier components use independently
Query Language N/A — credential request and presentation use OAuth-extended HTTP request/response patterns rather than a query language; OID4VP uses DIF Presentation Exchange for verifier requests
Data Formats W3C Verifiable Credentials Data Model (multiple formats including JWT-VC, JSON-LD VC with Data Integrity Proofs); IETF SD-JWT and SD-JWT VC; ISO/IEC 18013-5 mDoc; OAuth 2.0 token formats; JSON request/response payloads
Mobile Support Yes — major mobile wallet implementations exist for iOS and Android (EUDI Wallet reference implementations, Sphereon mobile wallet, MATTR Pi Wallet, and others)
Web Support Yes — web-based holder, issuer, and verifier flows are explicitly supported by the specification family; OID4VP supports both same-device (cross-app) and cross-device (QR code) flows
Native Apps Yes — desktop and mobile native wallets, issuer-side server software, and verifier-side server software
Terms Free open standard (no licensing fees; specifications published under the OpenID Foundation Intellectual Property Rights Policy which provides royalty-free licensing for Final Specifications)
Funds N/A — open standard, no funding round
Based On OAuth 2.0 (RFC 6749 — the underlying authorization framework); OpenID Connect (built on OAuth 2.0); W3C Verifiable Credentials Data Model (the credential format OID4VC issues and presents); IETF SD-JWT (selective-disclosure JWT format used widely with OID4VC); DIF Presentation Exchange 2.0 (used by OID4VP for verifier credential requests); ISO/IEC 18013-5 (mDoc format also supported)
Permissions OpenID Foundation Intellectual Property Rights Policy (royalty-free licensing for Final Specifications); specifications themselves are freely available
Authentication & Identity Issuer-Holder-Verifier credential model (the three-party model for VC issuance and presentation); identity proven via the credential rather than via a federated identity provider; SIOPv2 enables self-issued identity (the holder is their own OpenID Provider)
Storage Model N/A — protocol-level specification; credentials are stored in the holder's wallet of choice
Interoperability High: works with any W3C VC format (JSON-LD, JWT-VC, SD-JWT VC), with ISO/IEC 18013-5 mDocs, and with various DID methods; designed to be wallet-agnostic and credential-format-agnostic; major implementations exist across multiple vendors; foundational to the EU Digital Identity Wallet interoperability requirements
Data Portability Full portability: protocol-level standard, so credentials obtained via OID4VCI can be stored in any wallet that supports the relevant credential format; the wallet-to-verifier exchange via OID4VP is wallet-portable
Governance & Decision Making OpenID Foundation Digital Credentials Protocols Working Group (multi-stakeholder, open participation under OIDF membership); transparent voting process for Final Specification approval (OID4VCI 1.0 approved with 102 affirmative votes in September 2025)
Protocol Maturity / Standardization OpenID Final Specification — OID4VCI 1.0 is a Final Specification (approved September 2025, not subject to further revision); OID4VP and SIOPv2 at Implementer's Draft or Working Group Draft stage; OID4VC HAIP 1.0 for interoperability profile
Identity Standards OAuth 2.0 (RFC 6749); OpenID Connect Core; W3C Verifiable Credentials Data Model; W3C Decentralized Identifiers (compatible but not required); IETF SD-JWT and SD-JWT VC; DIF Presentation Exchange 2.0; ISO/IEC 18013-5 (mDoc); OID4VC High Assurance Interoperability Profile (HAIP) for SD-JWT VC and mDoc
DID Methods Supported DID-method-agnostic (works with any DID method or with non-DID identifiers; specific deployments choose their preferred methods — e.g., did:web, did:jwk, did:ion, did:ebsi all seen in production OID4VC deployments)
Key Management N/A — protocol-level specification; key management is the responsibility of the issuer, wallet, and verifier components independently
Credential Types W3C Verifiable Credentials (JSON-LD and JWT-VC forms); IETF SD-JWT VC (selective-disclosure JSON Web Tokens carrying VCs); ISO/IEC 18013-5 mDoc (the ISO mobile-driver-license credential format); any credential format negotiated between issuer and wallet
Verification Method Cryptographic signature verification on credentials (specific algorithms depend on credential format); for SD-JWT VC: signature verification plus selective-disclosure verification; for mDoc: ISO/IEC 18013-5 verification rules; OAuth bearer-token verification for protocol-level authorization
Privacy Features Selective disclosure (via SD-JWT VC); minimal disclosure (the verifier specifies which claims are required via Presentation Exchange); credential-format-level privacy properties (e.g., BBS+ signatures for unlinkability when used with appropriate credential formats); pseudonymous authentication possible via SIOPv2
Authentication Methods OAuth 2.0 client authentication (for issuer endpoints); proof-of-possession via DPoP or via the wallet's cryptographic proof in OID4VP; SIOPv2 self-issued ID Tokens for direct holder-to-verifier authentication
Revocation Mechanism N/A — protocol-level specification; revocation is handled by the credential format used (e.g., W3C Status List 2021, IETF Token Status List, or credential-format-specific revocation mechanisms)
Agent Types Supported Humans (primary intended user); organizations (as issuers and verifiers); supports both natural-person and legal-person credential subjects
Wallet/Client Types Any OID4VC-compatible digital wallet (EUDI Wallet reference implementations, Sphereon SSI Wallet, MATTR Pi Wallet, Microsoft Authenticator, Trinsic, and many others); browser-based wallets and native mobile wallets both supported
Recovery Mechanisms N/A — protocol-level specification; recovery depends on the wallet's own key-recovery model
Compliance / Regulations Designed for compliance with EU eIDAS 2.0 / EUDI Wallet requirements; supports the High Assurance Interoperability Profile (HAIP) for high-assurance use cases; broad alignment with GDPR data-minimization principles via selective disclosure
Credential Exchange Protocols OID4VCI for issuance (wallet requests credential, issuer issues); OID4VP for presentation (verifier requests, wallet presents with Presentation Exchange definitions); SIOPv2 for self-issued identity; transport over standard HTTPS with OAuth 2.0 authorization flows; cross-device flows use QR codes or deep links
Trust Framework Issuer-trust-based (verifiers maintain lists of trusted issuers, often via Trust Anchor lists or EU-style Trust Frameworks like the EBSI Trusted Issuer Registry); credential trust is anchored in the issuer's public key, resolved via DID method or via X.509 trust chain
Cost Model Free open standard for adoption (no usage fees); cost of running issuer and verifier infrastructure borne by implementers
Censorship Resistance Moderate: protocol depends on standard HTTPS and OAuth 2.0 infrastructure; in OID4VCI flows the issuer is a centralized server (a censorship point); however the credentials, once issued, are portable across wallets and verifiers, providing significant censorship resistance at the credential-use layer