---
title: "Pre-Authorized Code Flow"
description: "Full sequence diagram for issuing a credential via the OID4VCI Pre-Authorized Code Flow."
stack: "Community Stack (open source) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/issuer2/protocol-flows/pre-authorized-flow
generated: 2026-07-20
---
# Pre-Authorized Code Flow

This flow covers your application creating a credential offer, and the wallet claiming it via OID4VCI with no user login. Set `"authMethod": "PRE_AUTHORIZED"` when [creating the offer](https://docs.walt.id/community-stack/issuer2/credential-offers/create-offer.md) to use it.

**Components involved:**
- Your Application — creates the credential offer and displays the QR code
- Wallet (Holder) — scans the QR code, completes the OID4VCI flow, stores the credential
- Issuer2 API — manages the issuance session, validates the code/PIN, and signs the credential

```mermaid
sequenceDiagram
    participant App as Your Application
    participant Wallet as Wallet<br/>(Holder)
    participant Issuer as Issuer2 API

    App->>Issuer: POST /issuer2/credential-offers<br/>{profileId, authMethod: PRE_AUTHORIZED}
    activate Issuer

    Issuer->>Issuer: Create issuance session and<br/>pre-authorized code (+ optional txCode/PIN)

    Issuer-->>App: 201 Created<br/>{credentialOffer: "openid-credential-offer://..."}
    deactivate Issuer

    App->>App: Generate QR code with<br/>credential offer URL

    App-->>Wallet: Display QR code<br/>(openid-credential-offer://...)

    Wallet->>Wallet: Scan QR code
    Wallet->>Wallet: Parse credential offer URI

    Wallet->>Issuer: GET /.well-known/openid-credential-issuer/openid4vci
    Issuer-->>Wallet: Issuer metadata

    Wallet->>Issuer: POST /token<br/>(pre-authorized_code [+ tx_code])
    activate Issuer
    Issuer->>Issuer: Validate code (+ PIN if configured)
    Issuer-->>Wallet: access_token
    deactivate Issuer

    Wallet->>Issuer: POST /nonce
    activate Issuer
    Issuer->>Issuer: Generate fresh c_nonce
    Issuer-->>Wallet: {c_nonce}
    deactivate Issuer

    Wallet->>Wallet: Generate proof of possession<br/>(incl. sign c_nonce with holder key)

    Wallet->>Issuer: POST /credential<br/>(access_token, proof)
    activate Issuer

    Issuer->>Issuer: Resolve profile, apply<br/>mapping / data functions

    Issuer->>Issuer: Sign credential<br/>with issuerKey

    Issuer-->>Wallet: 200 OK<br/>{credential}
    deactivate Issuer

    Wallet->>Wallet: Store credential
```

**Note:**

This diagram is a simplified overview focused on how the Issuer2 API behaves. It omits some protocol details (e.g. metadata discovery of the Nonce Endpoint, PKCE, and exact `.well-known` paths). For the complete, normative sequence see the [OpenID for Verifiable Credential Issuance 1.0 specification](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html).

## Related

- [Credential Issuance](https://docs.walt.id/community-stack/issuer2/credential-issuance/sd-jwt-vc.md) — Try this flow end-to-end
- [Create an Offer](https://docs.walt.id/community-stack/issuer2/credential-offers/create-offer.md) — `txCode` and other offer parameters
- [Authorization Code Flow](https://docs.walt.id/community-stack/issuer2/protocol-flows/authorization-code-flow.md) — The alternative flow, when user login is required