References and Standards

The Issuer Service is built on open, standards-based specifications so that the credentials it issues remain interoperable with third-party wallets and verifiers. The references below cover the credential data models, identifier methods, issuance and presentation protocols, and query languages the service implements.

Credential data models and formats

• W3C Verifiable Credentials Data Model: https://www.w3.org/TR/vc-data-model/ The underlying data model for verifiable credentials. The service issues JWT-VC-JSON credentials (jwt-vc-json / jwt_vc_json) that follow this model.

• SD-JWT VC (Selective Disclosure JWT Verifiable Credentials): https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/ The format used for SD-JWT VC credentials (vc+sd-jwt / sd-jwt-vc). Each SD-JWT VC carries a vct (Verifiable Credential Type) and supports selective disclosure of individual claims. For example, a schema named EmployeeBadge at version 1.0 yields the credential configuration [email protected]:sd-jwt.

• Selective Disclosure for JWTs (SD-JWT): https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/ The underlying mechanism that lets a holder reveal only selected claims when presenting an SD-JWT VC. A schema's disclosureFrame declares which claims are selectively disclosable.

Identifiers

• DID Core Specification: https://www.w3.org/TR/did-core/ The base specification for Decentralized Identifiers and DID documents.

• DID Method: did:web: https://w3c-ccg.github.io/did-method-web/ HTTPS-resolvable DIDs. The service hosts the DID document itself and serves it at /{uuid}/did.json (also at /{uuid}/.well-known/did.json).

• DID Method: did:key: https://w3c-ccg.github.io/did-method-key/ Self-contained DIDs (Ed25519) that encode the public key directly in the identifier, requiring no network lookup.

Issuance and presentation protocols

• OpenID for Verifiable Credential Issuance (OpenID4VCI): https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html The protocol the Issuer Service uses to deliver credentials to wallets. The service implements the pre-authorized code flow with an optional PIN.

• OpenID for Verifiable Presentations (OpenID4VP): https://openid.net/specs/openid-4-verifiable-presentations-1_0.html The protocol used to request and receive verifiable presentations from wallets when a credential is later presented to a verifier. Authorization requests can target versions v1, v1.draft21, or v1.draft24.

Presentation query languages

• DIF Presentation Exchange v2: https://identity.foundation/presentation-exchange/ Describes the credentials a verifier requires in a presentation request.

• DCQL (Digital Credentials Query Language): https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#name-digital-credentials-query-l The OpenID4VP-native query language, supported as an alternative to DIF Presentation Exchange.

Ecosystem context

For the did:empe method and the EMPE blockchain, see Terminology and Concepts.