Product capabilities

Compare features across stacks

Explore what the Issuer, Verifier, and Wallet products offer across the Community and Enterprise Stacks. Filter by product or edition to focus on what matters for your rollout.

CapabilityCommunity StackEnterprise Stack
IssuerVerifierWallet

Credential Formats

SD-JWT VC (dc+sd-jwt), W3C VC as JWT (jwt_vc_json), ISO/IEC 18013-5 mdoc (mso_mdoc), and ISO/IEC 23220.

✓
✓
IssuerVerifierWallet

W3C VC JSON-LD

Linked-data credentials using ldp_vc. Current Issuer2, Verifier2, and Wallet2 stacks reject this format.

-
-
IssuerVerifierWallet

Protocols

OID4VCI 1.0 and OID4VP 1.0, plus ISO-18013-7 for mDL / mdoc remote flows. Deprecated v1 services still cover OID4VCI drafts 11/13 and OID4VP drafts 14/20.

✓
✓
IssuerVerifierWallet

Status Credential Formats

TokenStatusList (incl. draft 8), Bitstring Status List v1.0, StatusList2021, RevocationList2020

✓
✓
VerifierWallet

Digital Credentials API

Unified browser API for credential issuance/verification; abstracts OID4VCI/VP & ISO-18013-7 for 1-click web integrations.

~
~
IssuerVerifierWallet

Same-device remote flow

User stays on one device for issuance or presentation, typically via redirect or in-app handover.

✓
✓
IssuerVerifierWallet

Cross-device remote flow

QR code or companion-device handover for issuance and remote presentation.

✓
✓
VerifierWallet

Proximity presentation

In-person credential share over BLE or NFC, including ISO/IEC 18013-5 proximity flows.

R
R
VerifierWallet

Selective disclosure

Only requested claims leave the wallet, using SD-JWT disclosures or mdoc namespaces.

✓
✓
VerifierWallet

Signed request object (JAR)

Wallet authenticates the verifier from a signed request object before showing consent.

✓
✓
VerifierWallet

Request by reference

Wallet fetches the presentation request from request_uri over HTTPS, including GET and POST retrieval.

✓
✓
VerifierWallet

X.509 verifier identity

Verifier identity from certificate-bound client identifiers, including x509_hash and x509_san_dns.

✓
✓
VerifierWallet

Posted / encrypted presentation responses

Authorization responses posted to response_uri as direct_post or encrypted direct_post.jwt.

✓
✓
IssuerWallet

Pushed Authorization Requests

Authorization parameters stay off the front channel via PAR during issuance.

✓
✓
IssuerWallet

PKCE (S256)

Public wallet clients bind the authorization code with S256 so it cannot be replayed.

~
~
IssuerWallet

DPoP

Access tokens are bound to the wallet key during issuance.

✓
✓
IssuerWallet

Wallet / client attestation

Issuer can accept only attested wallet software; wallets can send attestation headers.

✓
✓
IssuerWallet

Key attestation

Issuer can require hardware-backed or attested holder keys on the credential proof.

R
R
IssuerWallet

Signed and unsigned issuer metadata

Wallets consume unsigned HTTPS issuer metadata and can verify signed JWT issuer metadata.

✓
✓
IssuerWallet

Encrypted credential request

Wallet encrypts the credential request so the issuer receives it as JWE.

-
-
IssuerWallet

Encrypted credential response

Issuer encrypts the issued credential; the wallet must request and decrypt the JWE.

-
-
IssuerWallet

OID4VCI notification endpoint

Wallet reports accepted, failed, or deleted credentials to the issuer notification endpoint.

R
R
IssuerWallet

Present-to-obtain

Holder presents an existing credential before a new one is issued.

-
-
IssuerWallet

Nonce endpoint

Fresh c_nonce for proofs during OpenID4VCI issuance.

✓
✓