Glossary

Plain-language definitions of the terms Credenco uses across its products and content, from credential formats and protocols to the roles that issue, hold, and verify them.

Related reading: The EUDI Wallet for HR and recruitment

What word are you interested in?

Top searched:Verifiable Credential eIDAS 2.0 EUDI Wallet

In depth:Verifiable credentials explained TS11 explained DCQL explained OpenID4VCI issuance explained European Business Wallet explained Relying party explained All explainers

A

ARF: Architecture and Reference Framework: the European Commission’s technical specification of the EUDI Wallet ecosystem, fixing the roles, credential formats, protocols and trust infrastructure that eIDAS 2.0 only describes in law.
Attestation Provider: The collective term for a QEAA Provider, PuB-EAA Provider and non-qualified EAA Provider: the three roles the ARF defines for issuing attribute credentials.
Authentic Source: A repository or system, run by a public sector body or private entity, that holds and provides attributes and is considered the primary, authoritative record for them.

C

Credential Issuance Platform: The software an issuer uses to turn source data into verifiable credentials and deliver them to a wallet, typically over OpenID4VCI. Distinct from the Issuer role, which describes the party rather than the platform.
Credential Offer: The OpenID4VCI message, usually behind a QR code or link, with which an issuer starts issuance: it names the issuer, says which credentials are on offer, and tells the wallet how it may collect them.
Credential Verification API: The service interface a relying party calls to request and validate a presentation, covering signature checks, the trust chain, status and revocation, and the returned claims. Distinct from the Verifier role, which describes the party rather than the API.

D

DCQL: Digital Credentials Query Language: the JSON format a relying party uses inside an OpenID4VP presentation request to describe exactly which credentials and claims it needs, so any compliant wallet can parse the request without a bespoke integration.
DID: Decentralized Identifier: a globally unique identifier that does not depend on a central registry. DIDs let issuers, holders, and verifiers reference each other and resolve public keys without a central authority.
did:web: A DID method that anchors a DID document on a regular HTTPS domain (e.g. did:web:example.com), using existing web PKI instead of a blockchain or ledger.
did:webvh: DID Web with Verifiable History: a successor to did:web that adds a tamper-evident, verifiable history log of every DID document version, plus key pre-rotation and witnesses, so a DID document can't be silently rewritten.
Digital Credentials API: The W3C browser API that lets a website request a credential from a wallet on the same device, through the operating system, instead of through a QR code or a custom deep link. It carries an OpenID4VP or ISO/IEC 18013-7 exchange rather than replacing one.
Digital Identity Wallet: The general category of app that lets a holder store credentials and attributes and choose exactly what to share with a relying party; the EUDI Wallet is the EU’s specific, regulated implementation of it.
Digital Product Passport: A structured, machine-readable record that follows a product through its lifecycle, giving customers, businesses and authorities standardised access to its sustainability, durability and material data. Required under ESPR for product groups covered by a delegated act.
DIIP: Decentralized Identity Interop Profile: a FIDES Community profile that picks one coherent set of existing specs for credential-based interoperability where the wallet does not need to be trusted, such as diplomas, licences and business wallets.

E

EAA: Electronic Attestation of Attributes: any electronic attestation certifying attributes about a person or organisation, issued by any provider. A QEAA is its qualified, higher-assurance variant.
EBSI: European Blockchain Services Infrastructure: an EU network that anchors cross-border trust for verifiable credentials, such as which issuers and schemas are recognised, used by several EUDI Wallet pilots as their trust registry.
EBWOID: European Business Wallet Owner Identification Data: the attestation that identifies the organisation a European Business Wallet belongs to, carrying a cross-border unique identifier, the official legal name from the authentic register, the issuing authority and a trust anchor a verifier can check it against.
eIDAS 2.0: The revised European regulation on electronic identification and trust services. It mandates the EUDI Wallet and establishes the legal framework for verifiable credentials to carry legal validity across the European Union.
ESPR: The Ecodesign for Sustainable Products Regulation: the EU regulation, in force since July 2024, that sets ecodesign requirements for products and establishes the Digital Product Passport as the way to make that information available.
EUDI Wallet: The European Digital Identity Wallet required by eIDAS 2.0: each EU member state must provide at least one to natural and legal persons for storing and presenting identity data and attestations, and public sector bodies across the EU must accept it for online identification.
European Business Wallet: A cloud-based business identity wallet built for the European market: it lets organisations issue, hold, and verify verifiable credentials for company registration, tax IDs, and certifications, so counterparties across the EU can trust them instantly instead of re-checking documents. Credenco's Business Wallet is an implementation of this concept.

F

FIDES: FIDES - Accelerating Digital Trust: a European community that catalogues live digital identity implementations in its Ecosystem Explorer and Blue Pages, and maintains the DIIP interoperability profile.

H

HAIP: High Assurance Interoperability Profile: an OpenID Foundation specification that constrains OpenID4VC for use where a high level of security and privacy is required, such as government-issued identity and the EUDI Wallet.
Holder: The person or organisation that receives a verifiable credential, stores it in a wallet, and decides when and with whom to share it. The holder is not necessarily the subject the credential is about.
Holder Binding: Tying a credential to a cryptographic key the holder controls, so only the rightful holder can present it and a copied credential is useless. SD-JWT and SD-JWT VC implement it as Key Binding: the wallet signs a Key Binding JWT over a nonce and audience from the verifier.

I

ISO/IEC 18013-5: The international standard for a mobile driving licence: how a credential is stored on a phone and presented to a reader in person, offline or online. The format the mDL and mdoc are built on.
Issuer: The organisation that creates and cryptographically signs a verifiable credential (for example a government agency, a bank, or a chamber of commerce), vouching for the claims it contains.

K

KYB: Know Your Business: the checks an organisation performs to verify a business counterparty, such as its registration, UBOs, and authorised representatives. Business credentials let these facts be proven instantly instead of via manual document checks.
KYC: Know Your Customer: the checks an organisation performs to verify a customer's identity. Verifiable credentials let a customer reuse an identity check already performed elsewhere instead of repeating it for every new relationship.

L

Large Scale Pilots: The four consortia that tested the EU Digital Identity Wallet in real use cases between 2023 and 2025: EWC, POTENTIAL, NOBID and DC4EU, bringing together over 350 organisations from 26 member states plus Norway, Iceland and Ukraine under the Digital Europe Programme.
LEI: Legal Entity Identifier: a 20-character ISO 17442 code, issued by an accredited Local Operating Unit under GLEIF, that uniquely identifies a legal entity worldwide.
Level of Assurance: How much confidence a relying party can place in a claimed identity, based on how the holder was identified and how the credential is protected. eIDAS defines three levels: low, substantial and high; the EUDI Wallet is issued at high.

M

mDL: A mobile driving licence built to the ISO/IEC 18013-5 standard, stored and presented from a smartphone offline or online so any conforming reader can accept it regardless of who issued it.
mdoc: A mobile document in the ISO/IEC 18013-5 format: issuer-signed, CBOR-encoded data elements held on a phone that a reader can verify on the spot, including offline. The format the mDL is built on, and one of the two the EUDI Wallet uses.

O

OpenID4VCI: OpenID for Verifiable Credential Issuance: the protocol a wallet uses to request and receive a credential from an issuer over a standard OAuth2-based flow.
OpenID4VP: OpenID for Verifiable Presentations: the protocol a wallet uses to present one or more credentials to a verifier in response to a request, so the verifier can check them without a separate integration per issuer.
Organization Wallet: A digital identity wallet held by a legal entity rather than a natural person, letting a company issue, hold, and present verifiable credentials about itself. The European Business Wallet is the specific implementation of this concept for the European market.

P

PID: Person Identification Data: the government-issued identity credential at the core of every EUDI Wallet, holding attributes such as name, date of birth and a unique identifier, which other attestations are bound to.
Presentation Exchange: The specification a relying party uses to describe which credentials and claims it needs from a holder, so a wallet can automatically match the request against the credentials it holds.
PuB-EAA: An EAA issued by, or on behalf of, a public sector body under eIDAS 2.0. It sits between an ordinary EAA and a QEAA, drawing its trust from the issuing body’s public mandate rather than qualified trust service provider certification.

Q

QEAA: Qualified Electronic Attestation of Attributes: the qualified variant of an EAA, issued by a qualified trust service provider under eIDAS 2.0, carrying the same legal weight as a notarised paper document.
QERDS: Qualified Electronic Registered Delivery Service: an eIDAS trust service for sending and receiving electronic data, backed by an EU-wide legal presumption of who sent it, who received it, when, and that it arrived unaltered.
QES: Qualified Electronic Signature: an electronic signature created with a qualified device and certificate, which eIDAS gives the same legal effect as a handwritten signature throughout the EU.
QSeal: Qualified Electronic Seal: the organisation-level counterpart to a QES, created by a legal person with a qualified certificate and device, to which eIDAS attaches a presumption that the sealed data is unaltered and really came from that organisation.
QTSP: Qualified Trust Service Provider: a trust service provider granted qualified status by an EU member state supervisory body and listed on that country’s Trusted List. Under eIDAS it is the party allowed to issue qualified certificates, QES and QEAA.

R

Relying party: The organisation that requests a verifiable credential from a holder and relies on it to make a decision, such as a bank onboarding a new business or a shop checking a customer is old enough to buy an age-restricted product.
Revocation: The mechanism an issuer uses to invalidate a credential after it was issued (for example when a qualification expires or a registration is withdrawn), so verifiers checking it afterwards see it as no longer valid.
RPRC: Relying Party Registration Certificate: a signed record listing which attributes a relying party has registered to request from a Wallet Unit, and for what purpose. Each Member State decides whether to issue them. Distinct from the RPAC, which authenticates who the relying party is.

S

Same-device vs cross-device flow: The two ways a wallet and a website reach each other. Same-device means both are on one phone and the site hands over with a deep link or redirect. Cross-device means the site is on a desktop and the wallet scans a QR code, with the answer returning through the backend.
SD-JWT: Selective Disclosure JSON Web Token: a credential format that lets a holder reveal only some of the claims inside a signed token while keeping the rest hidden, without invalidating the issuer's signature.
SD-JWT VC: The IETF profile that defines how to use SD-JWT to issue and present verifiable credentials, adding a credential type claim, key binding, and issuer metadata rules on top of the underlying selective-disclosure mechanism. The EUDI ARF names it alongside mdoc as a format wallets must support.
Selective Disclosure: The ability to share only the specific attributes a verifier needs from a credential, for example proving you are over 18 without revealing your exact birth date. It is a core privacy property of modern credential formats such as SD-JWT.
Status List: A compact, signed bitstring an issuer publishes in which every credential it has issued has one index, so a verifier can check whether a credential is still valid without revealing to the issuer which one it looked up.

T

Trust Anchor: An authoritative entity, represented by a public key and its associated data, that a relying party accepts as the starting point for verifying a chain of trust.
Trust Framework: The set of technical standards, legal rules, and governance agreements that let issuers, holders, and verifiers rely on each other's credentials across organisations and borders, such as the framework eIDAS 2.0 establishes for the EU.
Trusted List: The authoritative register a verifier consults to decide whether an issuer is trusted. Each EU member state publishes one under eIDAS 2.0, naming the qualified trust service providers and issuers it authorises.
TS11: EC TS11 v1.0.1 (2026-01): the Commission technical specification defining the data models and HTTP API for the two EUDI Wallet catalogues -- the catalogue of attributes and the catalogue of Attestation Rulebooks.

U

UBO: Ultimate Beneficial Owner: the natural person who ultimately owns or controls a legal entity, directly or through a chain of other entities. KYB requires establishing who a business counterparty’s UBOs are.

V

Verifiable Credential: A tamper-evident digital claim about a person or organisation that can be cryptographically verified without contacting the party that issued it. Verifiable credentials replace paper documents and PDFs with data that a verifier can trust on its own.
Verifiable Presentation: The tamper-evident package a holder assembles from one or more verifiable credentials to share with a verifier in response to a specific request, bound to the holder presenting it.
Verifier: The party that checks a presented credential: validating the issuer's signature, confirming the credential has not been revoked, and reading only the claims the holder chose to disclose.

W

W3C VC: The World Wide Web Consortium's open data model for verifiable credentials. It defines how claims, issuers, and cryptographic proofs are structured so credentials remain interoperable across different wallets and platforms.
Wallet as a Service (WaaS): A delivery model in which a provider hosts and operates a wallet's issuance, storage, presentation, and underlying security on a buyer's behalf, rather than the buyer building and running that infrastructure itself.
Wallet Attestation: A signed data object, issued by a Wallet Provider, that describes the components of a Wallet Unit, its Wallet Instance and its secure key storage, so a PID Provider or Attestation Provider can check them before issuing a credential. It is never shown to Relying Parties. The ARF calls this a Wallet Unit Attestation (WUA).
Wallet Provider: The natural or legal person that supplies a Wallet Solution to users under eIDAS 2.0, responsible for its software, security guarantees and compliance obligations.
Wallet Unit: The unique configuration a Wallet Provider gives to one Wallet User: the Wallet Instance app together with the secure cryptographic application and device that generate and protect its keys.
WE BUILD: A European consortium of over 180 organisations building the infrastructure for an interoperable EU Digital Identity Wallet for businesses, and testing implementations against each other in its Interoperability Test Bed.
WIA: A Wallet Instance Attestation is a Wallet Provider-signed proof of a Wallet Instance's integrity and authenticity, presented to PID and Attestation Providers at issuance so they can check the wallet before issuing a credential.
WSCA: Wallet Secure Cryptographic Application: the ARF-defined application that manages a Wallet Unit's critical cryptographic assets, such as PID private keys, using the functions of a tamper-resistant Wallet Secure Cryptographic Device (WSCD). It does not support exporting private keys.
WSCD: A Wallet Secure Cryptographic Device is the tamper-resistant device that protects a Wallet Unit's keys, such as a remote HSM, a smart card, an eSIM or the phone's own secure hardware, managed through a Wallet Secure Cryptographic Application (WSCA).

Z

Zero-Knowledge Proof: A cryptographic method for proving a statement about a credential is true, such as being over 18, without revealing any of the underlying data the statement is based on.