#Overview

SD-JWT VC (dc+sd-jwt), W3C VC as JWT (jwt_vc_json), ISO/IEC 18013-5 mdoc (mso_mdoc), and ISO/IEC 23220.

OID4VCI 1.0 with pre-authorized and authorization-code flows; ISO-18013-7 for mDL / mdoc remote issuance. Deprecated Issuer v1 still covers drafts 11/13.

TokenStatusList (incl. draft 8), Bitstring Status List v1.0, StatusList2021, RevocationList2020

User stays on one device for issuance or presentation, typically via redirect or in-app handover.

QR code or companion-device handover for issuance and remote presentation.

Authorization parameters stay off the front channel via PAR during issuance.

Public wallet clients bind the authorization code with S256 so it cannot be replayed.

Access tokens are bound to the wallet key during issuance.

Issuer can accept only attested wallet software; wallets can send attestation headers.

Issuer can require hardware-backed or attested holder keys on the credential proof.

Wallets consume unsigned HTTPS issuer metadata and can verify signed JWT issuer metadata.

Wallet encrypts the credential request so the issuer receives it as JWE.

Issuer encrypts the issued credential; the wallet must request and decrypt the JWE.

Wallet reports accepted, failed, or deleted credentials to the issuer notification endpoint.

Fresh c_nonce for proofs during OpenID4VCI issuance.