#Wallet Service Configuration

wallet-service.conf configures the core Wallet API v2 service. It is loaded by the wallet-service base feature.

#File Location

waltid-services/waltid-wallet-api2/config/wallet-service.conf

#Fields

#publicBaseUrl

String — Public-facing base URL of the wallet service.

The value is used when building response and redirect URLs, such as OID4VCI/OID4VP redirect URIs. It is the URL end users reach the wallet at, which is not necessarily the same as the API's bind port (webPort); typically it points at the user-facing wallet frontend.

publicBaseUrl = "http://localhost:4000"

The value can be overridden with the WALLET_PUBLIC_BASE_URL environment variable.

#clientIdTrust

Object — Wallet-controlled trust used to authenticate OpenID4VP Request Objects. Loaded from wallet-service.conf.

OpenID4VP x509_san_dns and x509_hash clients fail closed unless x509TrustAnchors is non-empty. Unsigned or untrusted X.509 verifiers are rejected.

#clientIdTrust.x509TrustAnchors

String — PEM-encoded X.509 trust anchors. The leaf in the verifier x5c header must chain to one of these anchors. If KeyUsage is present it must include digitalSignature; if absent, RFC 5280 treats the key as unrestricted. If ExtendedKeyUsage is present it must include TLS clientAuth (1.3.6.1.5.5.7.3.2) or mdoc reader authentication (1.0.18013.5.1.6); if absent, EKU is unrestricted. Include both extensions when issuing verifier Request Object leaves.

#clientIdTrust.trustedVerifierAttestationIssuers

String — DIDs allowed to issue verifier-attestation JWTs for the verifier_attestation client ID prefix.

#clientIdTrust.preRegisteredClients

Object — Metadata for OpenID4VP pre-registered client IDs. Keys are the exact client_id strings (including URL-shaped ids such as https://verifier.example.com). Values are OpenID client metadata objects.

Empty (the default) fails pre-registered closed: unknown unprefixed ids are invalid_client, and pre-registered is omitted from client_id_prefixes_supported.

Unsigned pre-registered requests are accepted only when:

• the raw client_id is a key in this map, and
• the request response_uri or redirect_uri is listed in that entry's redirect_uris

Signed pre-registered requests also verify against stored jwks when the request is a JAR.

If the client is already registered and the request includes in-band client_metadata, the wallet rejects with invalid_client (OpenID4VP 1.0 §8.5). Do not send request client_metadata for registered ids.

URL-shaped ids authenticate as pre-registered only when the raw string is a map key. An unknown https://… client is an unsupported prefix, not a redirect_uri client.

#Example Configuration

# wallet-service.conf
publicBaseUrl = "http://localhost:4000"

# Required for OpenID4VP x509_san_dns / x509_hash verifiers. Empty fails those prefixes closed.
# clientIdTrust {
#   x509TrustAnchors = [
#     """-----BEGIN CERTIFICATE-----
#     ...
#     -----END CERTIFICATE-----"""
#   ]
#   # Optional. Empty fails pre-registered ids closed.
#   preRegisteredClients {
#     "verifier2" {
#       redirect_uris = ["https://verifier.example.com/verification-session/callback"]
#       # jwks { keys = [ ... ] }  # required when the registered client sends a signed JAR
#     }
#     "https://verifier.example.com" {
#       redirect_uris = ["https://verifier.example.com/verification-session/callback"]
#     }
#   }
# }

For production, set it to your public HTTPS URL:

publicBaseUrl = "https://wallet.example.com"