OpenID4VCI
OpenID4VCI, OpenID for Verifiable Credential Issuance, is the protocol a wallet uses to request and receive a credential from an issuer over a standard OAuth2-based flow.
A holder starts the flow from their wallet, either by scanning a QR code or following a deep link from an issuer's website or app, and the wallet fetches a credential offer describing which credential type is on offer and where to get it. The issuer authenticates the holder, for example through eID login or a document scan, and checks whatever proof of eligibility it needs before minting the credential, then returns it signed in a format such as SD-JWT VC or mdoc. Two issuance modes exist: pre-authorised code flow, where the holder already went through an out-of-band process such as a bank branch visit and just needs to pull the resulting credential into the wallet, and authorization code flow, which mirrors ordinary OAuth2 login and lets the issuance happen entirely online in one session. A key-binding proof ties the credential to a specific key held only by that wallet instance, so a stolen credential file cannot be replayed from a different device. OpenID4VCI is the issuance protocol the EUDI Wallet reference implementation is built on under eIDAS 2.0, so an issuer that supports it can reach every EU wallet through one integration rather than a custom connector per member state or per wallet provider. The same protocol works equally well for a mobile driving licence, a university diploma, or a business registration extract, since the credential's content is opaque to the transport layer that delivers it.
Related terms
Does OpenID4VCI work the same way for every type of credential?
Yes. OpenID4VCI is a transport and authorisation protocol, not a credential format, so the same flow issues an SD-JWT VC, an mdoc, or any other credential type an issuer supports. A wallet only needs to implement OpenID4VCI once to receive credentials from any issuer that speaks the same protocol, regardless of what the credential itself represents.