Issuing Credentials
This guide explains how to issue a verifiable credential from the operator panel: pick an assigned schema, fill in the claim values, create a credential offer, and hand it to a holder as a QR code or deep link—or claim it directly into one of your cloud wallets.
Every credential offer is an OpenID4VCI pre-authorized offer. The offer is delivered as an openid-credential-offer://... URI (rendered as a QR code), which a compatible wallet scans to collect the credential.
Open the Issue form
From the Sidebar Menu, open Issuers and select the Issuer you want to issue from.
On the Issuer detail page, open the Schemas tab. The Assigned schemas section lists every schema bound to this Issuer, grouped by name and credential type, with one row per version.
Find the schema version you want and click Issue credential. Note: the button is enabled only for Published schema versions; draft versions cannot be issued.
Fill in the claim fields
The Issue Credential form is generated automatically from the schema's claim definitions. Each property becomes an input, required fields are marked, and field titles and descriptions come from the schema.
Enter a value for every required claim (for example employee_id, full_name, department). Optional claims left blank are omitted from the credential.
Click Generate offer to create the offer.
Share the credential offer
After the offer is created, a QR Code panel appears next to the form with the offer rendered as a scannable image. From this panel you can:
Scan the QR code with a wallet to collect the credential.
Download the QR code as a PNG.
Print the QR code.
Copy offer URL to copy the raw
openid-credential-offer://...URI for sharing through another channel.
What gets sent
Issuing from the form creates the offer via the credential-offers endpoint of the selected Issuer.
Endpoint
POST /issuers/{issuerDid}/credential-offers/qr-code
Request Body
credentialConfigurationIds: the credential configuration to issue, in the form
Name@Version:format(e.g.EmployeeBadge@1:sd-jwt). The panel resolves this from the schema version you selected.issuanceMetadata.claimsByConfigurationId: the claim values you entered, keyed by the same configuration id.
The qr-code endpoint returns a PNG image of the QR code, with the offer URI in the X-Credential-Offer-Uri response header (and X-Pin when a PIN is required). The plain-JSON variant, POST /issuers/{issuerDid}/credential-offers, returns the offer details directly:
Response Body
credentialOfferUri: the
openid-credential-offer://...URI behind the QR code.issuanceSessionId: the id of the issuance session created for this offer; track its progress under the Issuer's Issuance Sessions tab.
userPin: present only when the offer requires a PIN (see below).
Track issuance sessions
Every offer creates an issuance session, listed under the Issuer's Issuance Sessions tab as a table of Session ID, State, and Created/Expires timestamps. Opening a session's Session Dashboard side panel re-displays the offer QR code for an active session, offers Copy offer URL, lists the issued credentials of a completed session, and lets you claim the offer straight into a cloud wallet.
SD-JWT VC and JWT-VC-JSON
A schema can be published in two credential formats, and each format produces its own credential configuration id:
SD-JWT VC — configuration id ends in
:sd-jwt(e.g.EmployeeBadge@1:sd-jwt). SD-JWT credentials support selective disclosure, so the holder can later reveal individual claims to a verifier instead of the whole credential. The claims a schema marks as selectively disclosable are defined when the schema is created.JWT-VC-JSON — configuration id ends in
:jwt-vc-json(e.g.EmployeeBadge@1:jwt-vc-json). The credential is a single signed JWT with all claims always present.
Pick the configuration that matches how the credential will be used: choose SD-JWT VC when holders need to share claims minimally, or JWT-VC-JSON for a simpler all-or-nothing credential.
The Issue Credential form resolves the credential configuration id automatically from the schema version you selected and issues that configuration; for a schema published in both formats, the panel picks one configuration for you. To issue a specific format, call POST /issuers/{issuerDid}/credential-offers with the exact credentialConfigurationIds you want (for example EmployeeBadge@1:jwt-vc-json).
PIN-protected offers
A credential offer can require the holder to enter a short transaction PIN before the credential is released. This binds collection to someone who has both the QR code and the PIN, which you can deliver over a separate channel.
When an offer requires a PIN, the offer is created with requirePin: true, the response includes a userPin value, and the QR-code response carries the PIN in the X-Pin header. Share that PIN with the holder out of band.
PIN-protected offers are created through the API: send requirePin: true in the body of POST /issuers/{issuerDid}/credential-offers (or its /qr-code variant). The Issue Credential form always creates offers without a PIN.
Claim into a cloud wallet
Instead of handing the QR code to an external wallet, you can claim the offer directly into one of your own cloud wallet holders—useful for testing an end-to-end flow.
In the QR Code panel, find the Claim with wallet section.
Select a holder from the Wallet dropdown (the list shows the holders you have created).
Click Claim.
The panel sends the offer URI to the selected holder, which collects the credential into its wallet. On success you are taken to that holder's Credentials view, where the new credential appears.
Endpoint
POST /holders/{holderId}/process
Request Body
Response Body
If you need to claim into a holder that does not yet exist, create one first from the Holders section, then return to the offer and select it in the Wallet dropdown.
Last updated