HomeOpenID4VCICredential Offer

Credential Offer

The Credential Offer is the starting point for issuer-initiated issuance. It tells the wallet what credentials are available and how to get them.

Offer Structure

A Credential Offer is a JSON object that identifies the issuer, lists available credentials, and specifies how the wallet should obtain them.

Pre-Authorized Code Offer

{
  "credential_issuer": "https://issuer.example.com",
  "credential_configuration_ids": [
    "UniversityDegreeCredential"
  ],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "adhjhdjajkdkhjhdj",
      "tx_code": {
        "input_mode": "numeric",
        "length": 6,
        "description": "Enter the 6-digit code sent to your phone"
      }
    }
  }
}

Authorization Code Offer (Multiple Credentials)

{
  "credential_issuer": "https://issuer.example.com",
  "credential_configuration_ids": [
    "DriverLicenseCredential",
    "InsuranceCredential"
  ],
  "grants": {
    "authorization_code": {
      "issuer_state": "eyJhbGciOiJSU0Et..."
    }
  }
}

Offer Properties

Property	Type	Required	Description
credential_issuer	string (URL)	Required	URL identifying the Credential Issuer. Used to fetch metadata.
credential_configuration_ids	Array<string>	Required	IDs of credentials being offered, matching keys in issuer metadata.
grants	object	Optional	Specifies which grant types can be used. If omitted, authorization_code is assumed.

credential_issuerRequired

Type:string (URL)

URL identifying the Credential Issuer. Used to fetch metadata.

credential_configuration_idsRequired

Type:Array<string>

IDs of credentials being offered, matching keys in issuer metadata.

grantsOptional

Type:object

Specifies which grant types can be used. If omitted, authorization_code is assumed.

Grant Configuration

The grants object specifies which OAuth grant types can be used and provides necessary parameters for each.

Property	Type	Required	Description
authorization_code.issuer_state	string	Optional	State to include in authorization request. Helps issuer correlate requests.
authorization_code.authorization_server	string	Optional	URL of authorization server if different from default.
pre-authorized_code.pre-authorized_code	string	Required	The pre-authorized code to exchange for tokens.
pre-authorized_code.tx_code	object	Optional	Describes expected transaction code format.

authorization_code.issuer_stateOptional

Type:string

State to include in authorization request. Helps issuer correlate requests.

authorization_code.authorization_serverOptional

Type:string

URL of authorization server if different from default.

pre-authorized_code.pre-authorized_codeRequired

Type:string

The pre-authorized code to exchange for tokens.

pre-authorized_code.tx_codeOptional

Type:object

Describes expected transaction code format.

tx_codeTransaction Code Object

When present, the wallet must prompt the user for a PIN/code sent via separate channel.

"tx_code": {
  "input_mode": "numeric",   // "numeric" or "text"
  "length": 6,               // expected length
  "description": "Enter the code from your SMS"  // user-facing (max 300 chars)
}

Pre-Authorized Code Security

Pre-authorized codes are single-use and short-lived. Using tx_code adds a second factor to prevent interception. The code should be sent via a different channel than the offer.

Transmission Methods

The Credential Offer can be transmitted by value (embedded) or by reference (URL).

By Value

The entire offer is URL-encoded in the credential_offer parameter.

openid-credential-offer://?
  credential_offer=undefined

By Reference

A URL points to the offer JSON. The wallet fetches it.

openid-credential-offer://?
  credential_offer_uri=https://issuer.example.com/offers/abc123

QR Code

Encode the offer URI as a QR code. User scans with wallet app. Best for in-person scenarios (kiosk, printed material).

Deep Link

Use openid-credential-offer:// scheme for mobile deep linking. Alternatively use HTTPS with universal links.

Same-Device Flow

If wallet and browser are on same device, use HTTPS redirect. The wallet intercepts the URL via app link handling.

Issuance Flows Endpoints