Skip to content
Agent Identity

OIDF · Final approved 16 September 2025

OpenID for Verifiable Credential Issuance 1.0

openid-4-verifiable-credential-issuance-1_0-final

OIDF FinalStableIdentityAdjacent

If your org issues an 'this agent is owned by Acme' credential, OpenID4VCI is the likely issuance protocol, with OpenID4VP for presentation.

At a glance

Problem
Wallets need an OAuth-protected API to obtain credentials (SD-JWT VC, mdoc, W3C VCDM) from an issuer.
Identity / authn / authz
Issuance of identity (and other) credentials. Access to the issuance API is OAuth authorization.

Actors

  • Issuer
  • Wallet
  • Authorization server
  • User

When this matters for agents

When this matters for agents: if your org issues an 'this agent is owned by Acme' credential, OpenID4VCI is the likely issuance protocol, with OpenID4VP for presentation. The OAuth access token at the credential endpoint is not the VC.

Flow in plain language

Credential offer, authorization, token, credential (and optional deferred) endpoints. Pre-authorized code grant is common. Proof JWTs bind the credential to a holder key.

Key tokens and claims

access token for credential endpoint
OAuth token authorizing issuance, not the VC itself.

Implementer notes

Issuers can extend existing OIDC providers. Formats are not limited to W3C VCs.

Relationship to others

Primary sources

  • OpenID4VCI 1.0https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html