Digital credential glossary

Plain-language definitions of the terms Credenco uses across its products and content, from credential formats and protocols to the roles that issue, hold, and verify them.

ARF: Architecture and Reference Framework: the European Commission’s technical specification of the EUDI Wallet ecosystem, fixing the roles, credential formats, protocols and trust infrastructure that eIDAS 2.0 only describes in law.
Attestation Provider: The collective term for a QEAA Provider, PuB-EAA Provider and non-qualified EAA Provider: the three roles the ARF defines for issuing attribute credentials.
Authentic Source: A repository or system, run by a public sector body or private entity, that holds and provides attributes and is considered the primary, authoritative record for them.
Credential Issuance Platform: The software an issuer uses to turn source data into verifiable credentials and deliver them to a wallet, typically over OpenID4VCI. Distinct from the Issuer role, which describes the party rather than the platform.
Credential Offer: The OpenID4VCI message, usually behind a QR code or link, with which an issuer starts issuance: it names the issuer, says which credentials are on offer, and tells the wallet how it may collect them.
Credential Verification API: The service interface a relying party calls to request and validate a presentation, covering signature checks, the trust chain, status and revocation, and the returned claims. Distinct from the Verifier role, which describes the party rather than the API.
DID: Decentralized Identifier: a globally unique identifier that does not depend on a central registry. DIDs let issuers, holders, and verifiers reference each other and resolve public keys without a central authority.
did:web: A DID method that anchors a DID document on a regular HTTPS domain (e.g. did:web:example.com), using existing web PKI instead of a blockchain or ledger.
did:webvh: DID Web with Verifiable History: a successor to did:web that adds a tamper-evident, verifiable history log of every DID document version, plus key pre-rotation and witnesses, so a DID document can't be silently rewritten.
Digital Identity Wallet: The general category of app that lets a holder store credentials and attributes and choose exactly what to share with a relying party; the EUDI Wallet is the EU’s specific, regulated implementation of it.
DIIP: Decentralized Identity Interop Profile: a FIDES Community profile that picks one coherent set of existing specs for credential-based interoperability where the wallet does not need to be trusted, such as diplomas, licences and business wallets.
EAA: Electronic Attestation of Attributes: any electronic attestation certifying attributes about a person or organisation, issued by any provider. A QEAA is its qualified, higher-assurance variant.
EBSI: European Blockchain Services Infrastructure: an EU network that anchors cross-border trust for verifiable credentials, such as which issuers and schemas are recognised, used by several EUDI Wallet pilots as their trust registry.
EBWOID: European Business Wallet Owner Identification Data: the attestation that identifies the organisation a European Business Wallet belongs to, carrying a cross-border unique identifier, the official legal name from the authentic register, the issuing authority and a trust anchor a verifier can check it against.
eIDAS 2.0: The revised European regulation on electronic identification and trust services. It mandates the EUDI Wallet and establishes the legal framework for verifiable credentials to carry legal validity across the European Union.
EUDI Wallet: The European Digital Identity Wallet mandated by eIDAS 2.0: a wallet app every EU member state must offer citizens and businesses for storing and presenting verifiable credentials, recognised across all 27 member states.
European Business Wallet: A cloud-based business identity wallet built for the European market: it lets organisations issue, hold, and verify verifiable credentials for company registration, tax IDs, and certifications, so counterparties across the EU can trust them instantly instead of re-checking documents. Credenco's Business Wallet is an implementation of this concept.
FIDES: FIDES - Accelerating Digital Trust: a European community that catalogues live digital identity implementations in its Ecosystem Explorer and Blue Pages, and maintains the DIIP interoperability profile.
HAIP: High Assurance Interoperability Profile: an OpenID Foundation specification that constrains OpenID4VC for use where a high level of security and privacy is required, such as government-issued identity and the EUDI Wallet.
Holder: The person or organisation that receives a verifiable credential, stores it in a wallet, and decides when and with whom to share it. The holder is not necessarily the subject the credential is about.
ISO/IEC 18013-5: The international standard for a mobile driving licence: how a credential is stored on a phone and presented to a reader in person, offline or online. The format the mDL and mdoc are built on.
Issuer: The organisation that creates and cryptographically signs a verifiable credential (for example a government agency, a bank, or a chamber of commerce), vouching for the claims it contains.
KYB: Know Your Business: the checks an organisation performs to verify a business counterparty, such as its registration, UBOs, and authorised representatives. Business credentials let these facts be proven instantly instead of via manual document checks.
KYC: Know Your Customer: the checks an organisation performs to verify a customer's identity. Verifiable credentials let a customer reuse an identity check already performed elsewhere instead of repeating it for every new relationship.
Level of Assurance: How much confidence a relying party can place in a claimed identity, based on how the holder was identified and how the credential is protected. eIDAS defines three levels: low, substantial and high; the EUDI Wallet is issued at high.
mDL: A mobile driving licence built to the ISO/IEC 18013-5 standard, stored and presented from a smartphone offline or online so any conforming reader can accept it regardless of who issued it.
mdoc: A mobile document in the ISO/IEC 18013-5 format: issuer-signed, CBOR-encoded data elements held on a phone that a reader can verify on the spot, including offline. The format the mDL is built on, and one of the two the EUDI Wallet uses.
OpenID4VCI: OpenID for Verifiable Credential Issuance: the protocol a wallet uses to request and receive a credential from an issuer over a standard OAuth2-based flow.
OpenID4VP: OpenID for Verifiable Presentations: the protocol a wallet uses to present one or more credentials to a verifier in response to a request, so the verifier can check them without a separate integration per issuer.
Organization Wallet: A digital identity wallet held by a legal entity rather than a natural person, letting a company issue, hold, and present verifiable credentials about itself. The European Business Wallet is the specific implementation of this concept for the European market.
PID: Person Identification Data: the government-issued identity credential at the core of every EUDI Wallet, holding attributes such as name, date of birth and a unique identifier, which other attestations are bound to.
Presentation Exchange: The specification a relying party uses to describe which credentials and claims it needs from a holder, so a wallet can automatically match the request against the credentials it holds.
QEAA: Qualified Electronic Attestation of Attributes: the qualified variant of an EAA, issued by a qualified trust service provider under eIDAS 2.0, carrying the same legal weight as a notarised paper document.
QES: Qualified Electronic Signature: an electronic signature created with a qualified device and certificate, which eIDAS gives the same legal effect as a handwritten signature throughout the EU.
QTSP: Qualified Trust Service Provider: a trust service provider granted qualified status by an EU member state supervisory body and listed on that country’s Trusted List. Under eIDAS it is the party allowed to issue qualified certificates, QES and QEAA.
Relying party: The organisation that requests a verifiable credential from a holder and relies on it to make a decision, such as a bank onboarding a new business or a shop checking a customer is old enough to buy an age-restricted product.
Revocation: The mechanism an issuer uses to invalidate a credential after it was issued (for example when a qualification expires or a registration is withdrawn), so verifiers checking it afterwards see it as no longer valid.
SD-JWT: Selective Disclosure JSON Web Token: a credential format that lets a holder reveal only some of the claims inside a signed token while keeping the rest hidden, without invalidating the issuer's signature.
SD-JWT VC: The IETF profile that defines how to use SD-JWT to issue and present verifiable credentials, adding a credential type claim, key binding, and issuer metadata rules on top of the underlying selective-disclosure mechanism. The EUDI ARF names it alongside mdoc as a format wallets must support.
Selective Disclosure: The ability to share only the specific attributes a verifier needs from a credential, for example proving you are over 18 without revealing your exact birth date. It is a core privacy property of modern credential formats such as SD-JWT.
Status List: A compact, signed bitstring an issuer publishes in which every credential it has issued has one index, so a verifier can check whether a credential is still valid without revealing to the issuer which one it looked up.
Trust Anchor: An authoritative entity, represented by a public key and its associated data, that a relying party accepts as the starting point for verifying a chain of trust.
Trust Framework: The set of technical standards, legal rules, and governance agreements that let issuers, holders, and verifiers rely on each other's credentials across organisations and borders, such as the framework eIDAS 2.0 establishes for the EU.
Trusted List: The authoritative register a verifier consults to decide whether an issuer is trusted. Each EU member state publishes one under eIDAS 2.0, naming the qualified trust service providers and issuers it authorises.
UBO: Ultimate Beneficial Owner: the natural person who ultimately owns or controls a legal entity, directly or through a chain of other entities. KYB requires establishing who a business counterparty’s UBOs are.
Verifiable Credential: A tamper-evident digital claim about a person or organisation that can be cryptographically verified without contacting the party that issued it. Verifiable credentials replace paper documents and PDFs with data that a verifier can trust on its own.
Verifiable Presentation: The tamper-evident package a holder assembles from one or more verifiable credentials to share with a verifier in response to a specific request, bound to the holder presenting it.
Verifier: The party that checks a presented credential: validating the issuer's signature, confirming the credential has not been revoked, and reading only the claims the holder chose to disclose.
W3C VC: The World Wide Web Consortium's open data model for verifiable credentials. It defines how claims, issuers, and cryptographic proofs are structured so credentials remain interoperable across different wallets and platforms.
Wallet as a Service (WaaS): A delivery model in which a provider hosts and operates a wallet's issuance, storage, presentation, and underlying security on a buyer's behalf, rather than the buyer building and running that infrastructure itself.
Wallet Attestation: A cryptographic proof, issued by a Wallet Provider, that a specific Wallet Unit meets the technical and security requirements of the EUDI Wallet ecosystem, presented alongside a credential so a verifier can trust the wallet doing the presenting. The ARF calls this a Wallet Unit Attestation (WUA).
Wallet Provider: The natural or legal person that supplies a Wallet Solution to users under eIDAS 2.0, responsible for its software, security guarantees and compliance obligations.
Wallet Unit: The unique configuration a Wallet Provider gives to one Wallet User: the Wallet Instance app together with the secure cryptographic application and device that generate and protect its keys.
WE BUILD: A European consortium of over 180 organisations building the infrastructure for an interoperable EU Digital Identity Wallet for businesses, and testing implementations against each other in its Interoperability Test Bed.
Zero-Knowledge Proof: A cryptographic method for proving a statement about a credential is true, such as being over 18, without revealing any of the underlying data the statement is based on.