---
title: "Pre-Authorized Code Flow"
description: "Full sequence diagram for issuing a credential via the OID4VCI Pre-Authorized Code Flow with the walt.id Enterprise Issuer2 Service."
stack: "Enterprise Stack (commercial) — version 1.1.1"
stack_version: "1.1.1"
stack_comparison: https://docs.walt.id/community-vs-enterprise.md
canonical_url: https://docs.walt.id/enterprise-stack/services/issuer2-service/protocol-flows/pre-authorized-flow
generated: 2026-10-01
---
# Pre-Authorized Code Flow

This flow covers your application creating a credential offer, and the wallet claiming it via OID4VCI with no user login. Set `"authMethod": "PRE_AUTHORIZED"` when [creating the offer](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-offers/create-offer.md) to use it.

**Components involved:**

- **Your Application** — creates the credential offer and displays the QR code.
- **Wallet (Holder)** — scans the QR code, completes the OID4VCI flow, stores the credential.
- **Issuer2 Service** — manages the issuance session, validates the code/PIN, and signs the credential.

```mermaid
sequenceDiagram
    participant App as Your Application
    participant Wallet as Wallet<br/>(Holder)
    participant Issuer as Issuer2 Service

    App->>Issuer: POST /v2/{profileTarget}/issuer-service-api/credentials/offers<br/>Bearer token · {authMethod: PRE_AUTHORIZED}
    activate Issuer
    Issuer->>Issuer: Create issuance session and<br/>pre-authorized code (+ optional txCode/PIN)
    Issuer-->>App: 201 Created<br/>{credentialOffer: "openid-credential-offer://..."}
    deactivate Issuer

    App->>App: Generate QR code with<br/>credential offer URL
    App-->>Wallet: Display QR code<br/>(openid-credential-offer://...)

    Wallet->>Wallet: Scan QR code
    Wallet->>Wallet: Parse credential offer URI

    Wallet->>Issuer: GET issuer metadata<br/>(.well-known/openid-credential-issuer)
    Issuer-->>Wallet: Issuer metadata

    Wallet->>Issuer: POST .../openid4vci/token<br/>(pre-authorized_code [+ tx_code])
    activate Issuer
    Issuer->>Issuer: Validate code (+ PIN if configured)
    Issuer-->>Wallet: access_token
    deactivate Issuer

    Wallet->>Issuer: POST .../openid4vci/nonce
    activate Issuer
    Issuer->>Issuer: Generate fresh c_nonce
    Issuer-->>Wallet: {c_nonce}
    deactivate Issuer

    Wallet->>Wallet: Generate proof of possession<br/>(sign c_nonce with holder key)

    Wallet->>Issuer: POST .../openid4vci/credential<br/>(access_token, proof)
    activate Issuer
    Issuer->>Issuer: Resolve profile, apply<br/>mapping / data functions
    Issuer->>Issuer: Sign credential with issuer key
    Issuer-->>Wallet: 200 OK<br/>{credential}
    deactivate Issuer

    Wallet->>Wallet: Store credential
```

**Note:**

This diagram is a simplified overview focused on how the Issuer2 Service behaves. It omits some protocol details (e.g. metadata discovery of the Nonce Endpoint, PKCE, and exact `.well-known` paths). For the complete, normative sequence see the [OpenID for Verifiable Credential Issuance 1.0 specification](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html).

**Note:**

Only the **offer-creation** call is authenticated with your Enterprise Stack Bearer token. The wallet-facing OID4VCI endpoints (`token`, `nonce`, `credential`) are public.

## Related

- [Credential Issuance](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/sd-jwt-vc.md) — Try this flow end to end.
- [Create an Offer](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-offers/create-offer.md) — `txCode` and other offer parameters.
- [Authorization Code Flow](https://docs.walt.id/enterprise-stack/services/issuer2-service/protocol-flows/authorization-code-flow.md) — The alternative flow, when user login is required.