---
title: "mdoc Issuance via OID4VCI with Cloud KMS"
description: "Full sequence diagram for issuing an mdoc credential via OID4VCI, with signing delegated to an external Cloud KMS (TSE/Vault)."
stack: "Community Stack (open source) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/issuer/protocol-flows/mdoc-issuance-oid4vci-kms
generated: 2026-07-20
---
# mdoc Issuance via OID4VCI with Cloud KMS

This flow covers a portal initiating an mdoc credential offer, the wallet claiming it via OID4VCI, and the Issuer API delegating signing to an external Cloud KMS (TSE/Vault).

**Components involved:**
- Portal Application — initiates the credential offer and displays the QR code
- Wallet (Holder) — scans the QR code, completes the OID4VCI flow, stores the credential
- Issuer API — manages the issuance session and orchestrates signing
- Cloud KMS (TSE/Vault) — holds the issuer private key and performs signing

```mermaid
sequenceDiagram
    participant Portal as Portal Application
    participant Wallet as Wallet<br/>(Holder)
    participant Issuer as Issuer API
    participant KMS as Cloud KMS<br/>(TSE/Vault)

    Portal->>Issuer: POST /openid4vc/mdoc/issue
    activate Issuer

    Issuer->>Issuer: Create credential offer URI<br/>and issuance session

    Issuer-->>Portal: 200 OK<br/>{credentialOfferUri: "openid-credential-offer://..."}
    deactivate Issuer

    Portal->>Portal: Generate QR code with<br/>credential offer URI

    Portal-->>Wallet: Display QR code<br/>(openid-credential-offer://...)

    Wallet->>Wallet: Scan QR code
    Wallet->>Wallet: Parse credential offer URI

    Wallet->>Issuer: GET /.well-known/openid-credential-issuer
    Issuer-->>Wallet: Provider metadata

    Wallet->>Issuer: POST /token

    Wallet->>Wallet: Generate proof of possession<br/>(sign with holder key)

    Wallet->>Issuer: POST /credential
    activate Issuer

    Issuer->>Issuer: Resolve TSE key from<br/>issuerKey in request

    Issuer->>KMS: Authenticate with Vault
    activate KMS
    KMS-->>Issuer: Authentication successful
    deactivate KMS

    Issuer->>Issuer: Build credential structure<br/>with credentialData

    Issuer->>KMS: Request signature for credential
    activate KMS
    KMS->>KMS: Sign using private key
    KMS-->>Issuer: Signature bytes
    deactivate KMS

    Issuer->>Issuer: Complete mdoc signing<br/>with signature from KMS

    Issuer-->>Wallet: 200 OK
    deactivate Issuer

    Wallet->>Wallet: Store mdoc credential
```

## Related

- [Key Management — Hashicorp Vault](https://docs.walt.id/community-stack/issuer/key-management/hashicorp-vault.md)
- [mDL Issuance](https://docs.walt.id/community-stack/issuer/credential-issuance/mdl-oid4vc.md)