--- title: "Setup" description: "Create an Issuer2 service inside a tenant using the walt.id Enterprise Stack." stack: "Enterprise Stack (commercial) — version 0.21.0" stack_version: "0.21.0" stack_comparison: https://docs.walt.id/community-vs-enterprise.md canonical_url: https://docs.walt.id/enterprise-stack/services/issuer2-service/setup generated: 2026-07-20 --- # Setup This guide walks you through creating an Issuer2 service inside a tenant. The service declares which credential types it can issue (`credentialConfigurations`) and which KMS signs its tokens. If you don't have a tenant yet, learn how to create one [here](https://docs.walt.id/enterprise-stack/administration/tenants/create.md). ## Prerequisites Before creating an Issuer2 service, ensure you have: - **A tenant** — An existing tenant in your organization. - **A KMS service** — A [Key Management Service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) for storing signing keys. - **A token key** — A key in the KMS used to sign OID4VCI access tokens. --- ## Create an Issuer2 Service Services are created through the generic resource API. The body's `type` field selects the service kind (`issuer2`), and the new service's own ID is taken from the `target` in the path. **Option: CURL** **Endpoint:** `POST /v1/{target}/resource-api/services/create` | [API Reference](https://enterprise.sandbox.walt.id/swagger/index.html#/Service%20%7C%20Resource/post_v1__target__resource_api_services_create) ##### Example Request ```bash curl -X 'POST' \ 'https://{orgID}.enterprise-sandbox.waltid.dev/v1/{target}/resource-api/services/create' \ -H 'accept: application/json' \ -H 'Authorization: Bearer {yourToken}' \ -H 'Content-Type: application/json' \ -d '{ "type": "issuer2", "baseUrl": "https://myorg.enterprise-sandbox.waltid.dev", "kms": "waltid.tenant1.kms1", "tokenKeyId": "waltid.tenant1.kms1.tokenKey", "credentialConfigurations": { "identity_credential_vc+sd-jwt": { "format": "dc+sd-jwt", "vct": "{vctBaseURL}/identity_credential", "cryptographic_binding_methods_supported": ["jwk", "did:key", "did:web"], "credential_signing_alg_values_supported": ["ES256"], "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": ["ES256"] } } }, "UniversityDegree_jwt_vc_json": { "format": "jwt_vc_json", "cryptographic_binding_methods_supported": ["jwk", "did:key", "did:web", "did:jwk"], "credential_signing_alg_values_supported": ["ES256", "EdDSA"], "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": ["ES256", "EdDSA"] } }, "credential_definition": { "type": ["VerifiableCredential", "UniversityDegree"] } }, "org.iso.18013.5.1.mDL": { "format": "mso_mdoc", "doctype": "org.iso.18013.5.1.mDL", "cryptographic_binding_methods_supported": ["cose_key"], "credential_signing_alg_values_supported": [-7, -9], "proof_types_supported": { "jwt": { "proof_signing_alg_values_supported": ["ES256"] } } } }, "issuerDisplayConfiguration": [ { "name": "My Organization Issuer", "locale": "en-US", "logo": { "uri": "https://example.com/logo.png", "alt_text": "Organization logo" } } ] }' ``` **Path Parameters** - **orgID**: _String_ (required) - Your organization ID, i.e. its base URL. For an organization named `test`, this is `test.enterprise-sandbox.waltid.dev` on the sandbox environment. - **target**: _String_ (required) - The resource identifier for the new issuer service, `{organizationID}.{tenantID}.{newIssuerServiceID}`, e.g. `waltid.tenant1.issuer1`. **Header Parameters** - **Authorization**: _String_ (required) - Bearer token for Enterprise Stack authentication. Format: `Bearer {token}`. **Body Parameters** - **type**: _String_ (required) - Must be `issuer2` for the Issuer2 Service. - **kms**: _resourceIdentifier_ (required) - Reference to a [KMS service](https://docs.walt.id/enterprise-stack/services/key-management-service/overview.md) in the same tenant, e.g. `waltid.tenant1.kms1`. - **tokenKeyId**: _resourceIdentifier_ (required) - Reference to a key in the KMS used to sign OID4VCI access tokens, e.g. `waltid.tenant1.kms1.tokenKey`. - **credentialConfigurations**: _Object_ (required) - Map of the credential types this issuer supports, keyed by credential configuration ID. Each value declares `format`, signing/binding support, and format-specific fields (`vct`, `credential_definition`, or `doctype`). The example uses the self-hosted `{vctBaseURL}` VCT placeholder and integer COSE signing algorithms for the mDoc. See [Credential Types](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/credential-types.md) for the full field reference, validation rules, and per-format options. - **baseUrl**: _String_ (optional) - The public URL where the issuer is reachable; included in credential offers and OpenID metadata, e.g. `https://{orgID}.yourEnterpriseStackUrl.com`. - **issuerDisplayConfiguration**: _Array_ (optional) - Display metadata for the issuer, one entry per locale (`name`, `locale`, `logo`). See [Display Configuration](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/display-configuration.md). - **sdJwtVcTypeMetadataConfiguration**: _Object_ (optional) - Not shown above. Supplies a custom SD-JWT VC Type Metadata document to serve for a self-hosted `{vctBaseURL}` VCT, keyed by the same credential configuration ID as in `credentialConfigurations` (only valid for `dc+sd-jwt` configurations). If omitted, the issuer serves a minimal auto-generated document. This is distinct from a configuration's `credential_metadata` (wallet display/claims). See [VCT Handling](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/credential-types.md#vct-handling). - **clientAuthenticationConfig**: _Object_ (optional) - Declares which client authentication methods the issuer supports (anonymous pre-authorized code access and/or attestation-based wallet authentication). When a `client-attestation` method is included, token requests must carry valid `OAuth-Client-Attestation` and `OAuth-Client-Attestation-PoP` headers. See [Client Attestation — Issuer Integration](https://docs.walt.id/enterprise-stack/services/client-attestation-service/issuer-integration.md) for JSON shape, examples, and how this maps to authorization server metadata.
**Note:** Omit `clientAuthenticationConfig` entirely, or set `supportedMethods` to an empty list, to keep the default behavior where this layer does not enforce client authentication. Use `supportedMethods` with only `preauth-anonymous` when you want OID4VCI pre-authorized token requests without `client_id` but no wallet attestation. --- ##### Example Response ```json { "id": "waltid.tenant1.issuer1", "type": "issuer2", "baseUrl": "https://myorg.enterprise-sandbox.waltid.dev", "kms": "waltid.tenant1.kms1", "tokenKeyId": "waltid.tenant1.kms1.tokenKey", "credentialConfigurations": { "...": "..." }, "issuerDisplayConfiguration": [ "..." ] } ``` **Response Fields** - **id**: _String_ - The resource identifier of the created issuer service, `{organizationID}.{tenantID}.{issuerServiceID}`. - **type**: _String_ - The service type, `issuer2`. **Response Codes** - `201` — Service created successfully. - `400` — Invalid request body (e.g. an SD-JWT VC configuration missing `vct`). - `401` — Invalid or missing authentication token. - `409` — A service with this ID already exists. 🎉 You've created an Issuer2 service. --- ## Credential Types The `credentialConfigurations` map above declares one entry per credential type. Its shape depends on the `format` (`vct` for SD-JWT VC, `credential_definition` for W3C JWT, `doctype` for mDoc), and the service validates format-specific rules on create — binding/proof co-dependency, DID method form, and JOSE-vs-COSE signing identifiers. For the full field reference, validation rules, per-format examples, and VCT handling, see [Credential Types Configuration](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/credential-types.md). --- ## Next Steps After creating your Issuer2 service: 1. [Issue your first credential](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-issuance/sd-jwt-vc.md) – End-to-end guide from profile to a credential in a wallet. 2. [Create credential profiles](https://docs.walt.id/enterprise-stack/services/issuer2-service/credential-profiles/create-profile.md) – Define reusable configurations for each credential type. 3. [Configure display metadata](https://docs.walt.id/enterprise-stack/services/issuer2-service/configurations/display-configuration.md) – Customize how your issuer appears in wallets.