---
title: "Overview"
description: "The Client Attestation Service enables secure wallet authentication during credential issuance flows. It implements the OAuth 2.0 Attestation-Based Client Authentication specification, allowing issuers to verify that…"
stack: "Enterprise Stack (commercial) — version 0.21.0"
stack_version: "0.21.0"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/client-attestation-service/overview
generated: 2026-07-08
---
# Overview

The **Client Attestation Service** enables secure wallet authentication during credential issuance flows. It implements the [OAuth 2.0 Attestation-Based Client Authentication](https://datatracker.ietf.org/doc/draft-ietf-oauth-attestation-based-client-auth/) specification, allowing issuers to verify that credential requests originate from trusted wallet applications.

## What is Client Attestation?

Client attestation is a mechanism that allows an OAuth 2.0 authorization server (in this case, the Issuer2 Service) to verify the identity and integrity of a client application (wallet) before issuing credentials. This is particularly important in high-assurance credential issuance scenarios where the issuer needs to ensure that:

1. The wallet application is genuine and has not been tampered with
2. The wallet is authorized to receive credentials
3. The credential request originates from a trusted source

## How It Works

The client attestation flow involves three parties:

1. **Client Attester Service** – A trusted backend service that issues attestation JWTs to wallets
2. **Wallet Service** – The wallet application that obtains attestations and presents them to issuers
3. **Issuer2 Service** – The credential issuer that verifies attestations before issuing credentials

```mermaid
sequenceDiagram
    participant W as Wallet
    participant CA as Client Attester
    participant I as Issuer2

    Note over W,CA: 1. Wallet obtains attestation
    W->>CA: Request attestation (instance key)
    CA->>CA: Sign attestation JWT
    CA-->>W: Attestation JWT + expiry

    Note over W,I: 2. Wallet requests credential
    W->>W: Build PoP JWT (signed with instance key)
    W->>I: Token request + OAuth-Client-Attestation + OAuth-Client-Attestation-PoP headers
    I->>I: Verify attestation signature
    I->>I: Verify PoP signature matches cnf.jwk
    I->>I: Validate claims (exp, aud, iat, jti)
    I-->>W: Access token
    W->>I: Credential request
    I-->>W: Credential
```

## Key Concepts

### Attestation JWT

The attestation JWT is signed by the Client Attester Service and contains:

- `sub` – The client identifier (wallet ID)
- `exp` – Expiration timestamp
- `cnf.jwk` – The wallet's instance public key (used to verify the PoP)

### Proof of Possession (PoP) JWT

The PoP JWT is signed by the wallet using its instance key and proves that the wallet possesses the private key corresponding to the `cnf.jwk` in the attestation. It contains:

- `aud` – The issuer's RFC 8414 issuer identifier URL
- `iat` – Issuance timestamp
- `jti` – Unique identifier for replay protection

### HTTP Headers

Per the specification, attestation is transmitted via two HTTP headers on the token request:

- `OAuth-Client-Attestation` – Contains the attestation JWT
- `OAuth-Client-Attestation-PoP` – Contains the PoP JWT

## Verification Methods

The Issuer2 Service supports three methods for verifying attestation JWT signatures:

| Method | Description | Use Case |
|--------|-------------|----------|
| **Static JWK** | Verify against a static public key provided inline | Simple deployments, testing |
| **KMS Key** | Verify against a key stored in the KMS | When attester and issuer share the same enterprise instance |
| **X.509 Chain** | Verify via X.509 certificate chain validation; the leaf certificate public key must match the JWT `alg` (ECDSA **ES256**/**ES384**/**ES512**, or RSA **RS256**/**RS384**/**RS512** and **PS256**/**PS384**/**PS512**) | Regulated environments (e.g., VICAL, eIDAS) |

## Service Dependencies

The Client Attestation Service requires:

- **KMS Service** – For storing the attestation signing key

## Get Started

- [Setup](https://docs.walt.id/enterprise-stack/services/client-attestation-service/setup.md) – How to create and configure a Client Attestation Service
- [Wallet Integration](https://docs.walt.id/enterprise-stack/services/client-attestation-service/wallet-integration.md) – How wallets obtain and use attestations
- [Issuer Integration](https://docs.walt.id/enterprise-stack/services/client-attestation-service/issuer-integration.md) – How to configure issuers to require attestation

## Operational Endpoints

All lifecycle, configuration, dependency, and metadata operations for this service are documented under Administration → Service Operations:

- [Create this service](https://docs.walt.id/enterprise-stack/administration/services/create.md)
- [View or update configuration](https://docs.walt.id/enterprise-stack/administration/services/configuration/view.md)
- [Manage dependency services](https://docs.walt.id/enterprise-stack/administration/services/dependency-services/view.md)