Overview
The Issuer2 Service supports two OID4VCI flows for claiming a credential offer, selected via the authMethod field when creating a credential offer. This section walks through the full sequence for each so you know what happens between your application, the wallet, the issuer, and (for one of them) an external identity provider.
Which Flow Should I Use?
| Pre-Authorized Code Flow | Authorization Code Flow | |
|---|---|---|
authMethod | PRE_AUTHORIZED | AUTHORIZED |
| User authentication | None (optionally a PIN/txCode) | Required — the holder logs in at an external IdP |
| Best for | Known users (already verified) and data known before the offer is created | Unknown users, or credential data that should come from the user's own IdP login (e.g. corporate SSO) |
| Extra setup required | None | An external OAuth/OIDC provider configured via authProviderConfiguration on the issuer service (see Setup) |
| Credential data source | Fully defined in the profile (or runtime overrides) ahead of time | Profile defaults (or runtime overrides), enriched with claims from the IdP's ID token via idTokenClaimsMapping |
Available Flows
- Pre-Authorized Code Flow — Sequence diagram for issuing a credential with no user login.
- Authorization Code Flow — Sequence diagram for issuing a credential after the holder authenticates against an external IdP.
Last updated on July 20, 2026