Overview
The Wallet2 Service is walt.id's Enterprise wallet for receiving and presenting verifiable digital credentials using the finalized OID4VCI 1.0 and OID4VP 1.0 specifications (with DCQL). It supports consumer wallets for end users as well as organizational wallets for companies.
The original Wallet Service, which supports draft OpenID4VCI / OpenID4VP protocols (resource type wallet, /v1 API), remains available when the wallet-draft-routes feature is enabled. For new projects, we recommend the Wallet2 Service with OID4VCI/VP 1.0.
Supported Standards
| Credential Formats: | SD-JWT VC (IETF), W3C VC (v1.1+, v2.0), ISO 18013-5 mDL |
| Credential Exchange: | OID4VCI (v1.0), OID4VP (v1.0, DCQL), ISO/IEC 18013-7 |
| Signing Algorithms: | ed25519, secp256k1, secp256r1, RSA |
Service Type and API
Wallet2 is a distinct service type in the organization tree:
| Resource type | "wallet2" |
| API base | /v2/{target}/wallet-service-api/... |
| Feature flag | Always available (no special feature required) |
Existing nodes with type "wallet" are not served by the Wallet2 /v2 API. Create new wallets as "wallet2", or run the optional manual migration (_t: wallet → wallet2) before switching clients to /v2.
For end-to-end flows, pair Wallet2 with Issuer2 and Verifier2.
Core Features
KMS & Identifiers
- Holder Keys — Storage is configured via the KMS Service. Keys may reside in the Enterprise database for non-production setups or be delegated to providers such as AWS KMS, HashiCorp Vault, or Azure Key Vault.
- DIDs — Create and store DIDs with the DID Service and DID Store.
Credential Storage
- Persist received credentials using the Credential Store Service.
Credential Exchange
- Supports OID4VCI/VP 1.0 flows and ISO/IEC 18013‑7 for receiving and presenting credentials.
- Matches stored credentials against DCQL requests.
- Automatically proves key and DID ownership during exchanges.
- Supports attestation-based client authentication when the issuer’s authorization server metadata advertises
attest_jwt_client_auth(see wallet integration). Obtain/current attestation endpoints are available on the wallet; receive flows can auto-apply attestation when a client-attester dependency is linked.
Dependencies
Supported dependency service types: kms, did-store, credential-store, client-attester, and policy-store (Holder Policy Store). The policy store is always available and is not gated by wallet-draft-routes.
Optional static configuration (staticDid, staticKey) can be set on the wallet when you do not attach a KMS / DID store.
Getting Started
- Setup — Create a Wallet2 service (
type: wallet2) via composable init or resource create.
Receive, manage & present credentials
- Accept credentials via OID4VCI 1.0 — Receive and store W3C, SD-JWT VC, and mDL credentials.
- Manage credentials — List and retrieve the keys, DIDs, and credentials stored in a wallet.
- Share credentials via OID4VP 1.0 — Present stored credentials to any OID4VP verifier using DCQL.
- Silent issuance & verification — Programmatic credential exchange without interactive UX.