---
title: "Wallet Service"
description: "Reference for the wallet-service.conf configuration file."
stack: "Community Stack (open source) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/community-stack/wallet2/configurations/config-files/wallet-service
generated: 2026-10-01
---
# Wallet Service Configuration

`wallet-service.conf` configures the core Wallet API v2 service. It is loaded by the `wallet-service` base feature.

**Note:**

The shipped config sets `publicBaseUrl` to `http://localhost:4000`. A dedicated Wallet API v2 frontend is planned; until then this value is largely a placeholder, as the current API does not yet build user-facing redirect flows from it.

## File Location

```
waltid-services/waltid-wallet-api2/config/wallet-service.conf
```

## Fields

### `publicBaseUrl`

_String_ — Public-facing base URL of the wallet service.

The value is used when building response and redirect URLs, such as [OID4VCI](https://docs.walt.id/concepts/data-exchange-protocols/openid4vci.md)/[OID4VP](https://docs.walt.id/concepts/data-exchange-protocols/openid4vp.md) redirect URIs. It is the URL end users reach the wallet at, which is **not necessarily the same as the API's bind port** ([`webPort`](https://docs.walt.id/community-stack/wallet2/configurations/config-files/web.md)); typically it points at the user-facing wallet frontend.

```hocon
publicBaseUrl = "http://localhost:4000"
```

The value can be overridden with the `WALLET_PUBLIC_BASE_URL` environment variable.

### `clientIdTrust`

_Object_ — Wallet-controlled trust used to authenticate OpenID4VP Request Objects. Loaded from `wallet-service.conf`.

OpenID4VP `x509_san_dns` and `x509_hash` clients **fail closed** unless `x509TrustAnchors` is non-empty. Unsigned or untrusted X.509 verifiers are rejected.

#### `clientIdTrust.x509TrustAnchors`

_String[]_ — PEM-encoded X.509 trust anchors. The leaf in the verifier `x5c` header must chain to one of these anchors. If KeyUsage is present it must include `digitalSignature`; if absent, RFC 5280 treats the key as unrestricted. If ExtendedKeyUsage is present it must include TLS `clientAuth` (`1.3.6.1.5.5.7.3.2`) or mdoc reader authentication (`1.0.18013.5.1.6`); if absent, EKU is unrestricted. Include both extensions when issuing verifier Request Object leaves.

#### `clientIdTrust.trustedVerifierAttestationIssuers`

_String[]_ — DIDs allowed to issue verifier-attestation JWTs for the `verifier_attestation` client ID prefix.

#### `clientIdTrust.preRegisteredClients`

_Object_ — Metadata for OpenID4VP `pre-registered` client IDs. Keys are the exact `client_id` strings (including
URL-shaped ids such as `https://verifier.example.com`). Values are OpenID client metadata objects.

Empty (the default) fails `pre-registered` closed: unknown unprefixed ids are `invalid_client`, and
`pre-registered` is omitted from `client_id_prefixes_supported`.

Unsigned pre-registered requests are accepted only when:

- the raw `client_id` is a key in this map, and
- the request `response_uri` or `redirect_uri` is listed in that entry's `redirect_uris`

Signed pre-registered requests also verify against stored `jwks` when the request is a JAR.

If the client is already registered **and** the request includes in-band `client_metadata`, the wallet rejects
with `invalid_client` (OpenID4VP 1.0 §8.5). Do not send request `client_metadata` for registered ids.

URL-shaped ids authenticate as pre-registered **only** when the raw string is a map key. An unknown
`https://…` client is an unsupported prefix, not a `redirect_uri` client.

## Example Configuration

```hocon
# wallet-service.conf
publicBaseUrl = "http://localhost:4000"

# Required for OpenID4VP x509_san_dns / x509_hash verifiers. Empty fails those prefixes closed.
# clientIdTrust {
#   x509TrustAnchors = [
#     """-----BEGIN CERTIFICATE-----
#     ...
#     -----END CERTIFICATE-----"""
#   ]
#   # Optional. Empty fails pre-registered ids closed.
#   preRegisteredClients {
#     "verifier2" {
#       redirect_uris = ["https://verifier.example.com/verification-session/callback"]
#       # jwks { keys = [ ... ] }  # required when the registered client sends a signed JAR
#     }
#     "https://verifier.example.com" {
#       redirect_uris = ["https://verifier.example.com/verification-session/callback"]
#     }
#   }
# }
```

For production, set it to your public HTTPS URL:

```hocon
publicBaseUrl = "https://wallet.example.com"
```