--- title: "Overview" description: "Issue verifiable digital credentials via OID4VCI using the walt.id Enterprise Issuer2 Service." stack: "Enterprise Stack (commercial) — version 0.21.0" stack_version: "0.21.0" stack_comparison: https://docs.walt.id/community-vs-enterprise.md canonical_url: https://docs.walt.id/enterprise-stack/services/issuer2-service/overview generated: 2026-07-20 --- # Overview The **Issuer2 Service** is walt.id's Enterprise solution for creating, signing, and distributing verifiable digital credentials using multiple credential formats and standards. It implements the [OID4VCI v1.0](https://docs.walt.id/concepts/data-exchange-protocols.md) specification and introduces a profile-based architecture for easier credential issuance. Supported credential formats include [W3C VC](https://docs.walt.id/concepts/digital-credentials/verifiable-credentials-w3c.md), [SD-JWT VC (IETF)](https://docs.walt.id/concepts/digital-credentials/sd-jwt-vc.md), and [ISO 18013-5 mDL](https://docs.walt.id/concepts/digital-credentials/mdoc-mdl-iso.md). **Note:** The original [Issuer Service](https://docs.walt.id/enterprise-stack/services/issuer-service/overview.md), which supports Draft 11/13 of the OID4VCI specification, remains available for existing projects. For new projects, we recommend the **Issuer2 Service** with its profile-based architecture and OID4VCI v1.0 support. ## Supported Standards | | | |:-------------------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Credential Formats:** | [SD-JWT VC (IETF)](https://docs.walt.id/concepts/digital-credentials/sd-jwt-vc.md), [W3C VC (v1.1+, v2.0)](https://docs.walt.id/concepts/digital-credentials/verifiable-credentials-w3c.md), [ISO 18013-5 mDL](https://docs.walt.id/concepts/digital-credentials/mdoc-mdl-iso.md) | | **Credential Exchange:** | [OID4VCI](https://docs.walt.id/concepts/data-exchange-protocols.md) (v1.0) | | **Credential Status:** | [StatusList2021, Bitstring Status List, Token Status List](https://docs.walt.id/concepts/credential-lifecycle/credential-status-and-revocation.md) | | **Signing Algorithms:** | ed25519, secp256k1, secp256r1, RSA | --- ## How Issuance Works Issuing a credential with the Issuer2 Service follows four steps. The first two are one-time setup; the last two you repeat for every credential you issue. ```mermaid flowchart LR A["1 · Issuer Service
(credentialConfigurations)"] --> B["2 · Credential Profile
(key, DID, data template)"] B --> C["3 · Credential Offer
(OID4VCI URL)"] C --> D["4 · Wallet Claims
(credential issued)"] ``` 1. **Create the issuer service** — Declare the credential types it should support (`credentialConfigurations`) and point it at a KMS which manages the keys for signing. See [Setup](https://docs.walt.id/enterprise-stack/services/issuer2-service/setup.md). 2. **Create a credential profile** — Bind a credential type to an issuer key, DID or X509 certificate and a data template. See [Credential Profiles](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-profiles/overview.md). 3. **Create a credential offer** — Generate an OID4VCI offer URL from a profile, optionally overriding profile defaults per offer. See [Credential Offers](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-offers/overview.md). 4. **The wallet claims the offer** The [credential-issuance guides](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/sd-jwt-vc.md) take you through all four steps end to end for each format ([SD-JWT VC](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/sd-jwt-vc.md), [W3C VC](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/w3c-vc.md), [mDL](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/mdl.md)). --- ## Core Features ### Profile-Based Issuance The Issuer2 Service introduces a **profile-based architecture** that simplifies credential issuance: - **Credential Profiles** – Define reusable configurations for each credential type, including issuer keys, credential data templates, status configuration, and notification settings. - **Credential Offers** – Create offers from profiles with runtime overrides, supporting both pre-authorized and authorization code flows. ### Credential Exchange The Issuer2 Service supports credential exchange protocols based on: - **OID4VCI v1.0:** Flows such as Pre-Authorized Code Flow (with or without PIN/Transaction Code) and Authorization Code Flow (with ID Token, VP Token, username/password login, or integration with external authorization servers like Keycloak). See [Protocol Flows](https://docs.walt.id/enterprise-stack/services/issuer2-service/protocol-flows/overview.md). - **mDoc Issuance:** Remote issuance of Mobile Driver's Licenses (mDL) and other ISO 18013-5 credentials via OID4VCI (ISO 18013-7). ### Credential Data Collection Flexible data collection options allow populating credentials before or after an offer has been created: - **Before Credential Offer Creation** – Provide all subject data upfront when creating the profile or offer. - **After Credential Offer Creation & Before Credential Signing** – Enrich credentials dynamically using [data functions](https://docs.walt.id/enterprise-stack/services/issuer2-service/data-functions.md) such as webhooks or timestamps. - **During User Authentication** – When using the authorization code flow, the subject can authenticate against an external IdP and the retrieved claims are mapped to credential fields via `idTokenClaimsMapping`. ### Credential Branding Credential appearance in wallets can be defined via: - [**Issuer Metadata**](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/display-configuration.md) – Branding per credential type (background color, text color, logo, description). - **Embedded in Credential** – Include branding directly in the issued credential for case-specific styling. ### Credential Status & Lifecycle - Built-in status management through the [Credential Status Service](https://docs.walt.id/enterprise-stack/services/credential-status-service/overview.md), supporting StatusList2021, Bitstring Status List, and Token Status List. - Different credential formats have different status type compatibility: - **W3C JWT/SD-JWT**: Bitstring Status List, StatusList2021 - **SD-JWT VC (IETF)**: Token Status List - **mDoc**: Token Status List - Configure credential status at the profile level or override per offer. - Credentials can include expiration and "valid from" dates. ### Keys & DIDs - **Issuer Keys** – Store and manage keys via the [KMS Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md). The KMS service can use external KMS providers (e.g. Azure Key Vault, AWS KMS, OCI, Hashicorp Vault, ...) or store the keys in the Enterprise Stack database (only recommended for non-production use cases). - **DIDs** – Create and store DIDs via the [DID Service](https://docs.walt.id/enterprise-stack/services/did-service/overview.md), the [DID Registry](https://docs.walt.id/enterprise-stack/services/did-registry/overview.md) and the [DID Store](https://docs.walt.id/enterprise-stack/services/did-store-service/overview.md) - **X.509 Certificates** – Support for X.509 certificate chains (`x5Chain`) for mDL and other certificate-based credentials. ### Notifications & Session Events - Webhook-based notifications for real-time updates on issuance events, with bearer-token authentication for secure delivery. - A Server-Sent Events (SSE) stream for monitoring issuance session progress live. - Configure notifications at the profile level or override per offer. See [Notifications & Session Events](https://docs.walt.id/enterprise-stack/services/issuer2-service/notifications.md). ### Client Authentication - Client authentication is configured with `clientAuthenticationConfig` on the issuer service. You can enable one or both of: **anonymous pre-authorized code** (`preauth-anonymous` — OID4VCI token requests using `grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code` without `client_id`), and **attestation-based client authentication** (`client-attestation` — OAuth 2.0 Attestation-Based Client Auth). - When `client-attestation` is configured, only trusted wallets that present valid `OAuth-Client-Attestation` and `OAuth-Client-Attestation-PoP` headers can complete the token step; attestation JWT signatures are verified using a **static JWK**, a **KMS key**, or **X.509 chain** trust anchors (including regulated environments such as VICAL and eIDAS). - The issuer's RFC 8414 authorization server metadata reflects the active methods (for example `token_endpoint_auth_methods_supported`, `pre_authorized_grant_anonymous_access_supported`). - See [Client Attestation — Issuer Integration](https://docs.walt.id/enterprise-stack/services/client-attestation-service/issuer-integration.md) for configuration details. ### Session Data Retention & Auto-Purge - Issuance sessions can contain personally identifiable information (PII) such as offer payloads, subject data, and interaction logs. Enable the optional data-retention job to define a maximum issuer-session age, purge schedule, and safety guardrails so expired sessions are removed automatically. - Find out more about the [Data Retention](https://docs.walt.id/enterprise-stack/setup/configurations/config-files/data-retention.md) configuration options where you can set `maxIssuerSessionAge`, cron `schedule`, dry-run behavior, and deletion limits to meet your compliance requirements. --- ## Getting Started - [Setup](https://docs.walt.id/enterprise-stack/services/issuer2-service/setup.md) – Create an Issuer2 service inside your tenant. - [Issue SD-JWT VC / W3C VC / mDL](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/sd-jwt-vc.md) – End-to-end guides from an empty service to a credential in a wallet. - [Credential Profiles](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-profiles/overview.md) – Create and manage reusable credential configurations. - [Credential Offers](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-offers/overview.md) – Create credential offers from profiles. - [Protocol Flows](https://docs.walt.id/enterprise-stack/services/issuer2-service/protocol-flows/overview.md) – Pre-authorized and authorization code flow sequences. - [Configurations](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/overview.md) – Manage display metadata and service settings. - [Data Functions](https://docs.walt.id/enterprise-stack/services/issuer2-service/data-functions.md) – Populate credentials with dynamic data. - [Notifications & Session Events](https://docs.walt.id/enterprise-stack/services/issuer2-service/notifications.md) – Track issuance events via webhooks or SSE. - [Full API Reference](https://docs.walt.id/enterprise-stack/services/issuer2-service/full-api-reference.md) – Complete Swagger documentation.