How Credential Issuance Works

The Credential Issuance service lets users claim Verifiable Credentials (VCs) in their digital wallets, such as Affinidi Vault.

The service implements the OpenID for Verifiable Credential Issuance (OID4VCI) specification, which uses OAuth 2.0 to securely authorise and deliver credential offers. Users store accepted credentials in their Affinidi Vault.

Credential Issuance Configuration

Before integrating, create a configuration that includes the Wallet to cryptographically sign the VC and supported schemas for credential types.

Schemas define the data structure required to create a credential offer.

Credential Offer

Before users can claim Verifiable Credentials (VCs) in their digital wallets, your application must first create a credential offer. This offer includes the user’s claims, the method for claiming the credential (defined by the claim mode), and whether the credential is revocable.

For example, if you’re running an online course platform, you can issue a credential that verifies a student has completed a course.

In the diagram below, your application would call the Credential Issuance service to generate a credential offer containing the course and user details. The service returns a URI and a transaction code, which your application then sends to the user so they can claim the credential from Affinidi Vault.

sequenceDiagram
    actor User
    participant Website
    participant Credential Issuance Service

    User-->>Website: Completes a course and request for certificate.
    Website->>Credential Issuance Service: Create a credential offer for the user
    Note over Website, Credential Issuance Service:  Credential data includes the supported Schema, User's wallet DID, and credential details to issue
    Credential Issuance Service->>Credential Issuance Service: Validates the credential data based on Issuance Configuration
    Credential Issuance Service->>Credential Issuance Service: Signs the Credential with the configured wallet
    Credential Issuance Service->>Website: Returns the Transaction Code and Offer URI to claim the credential from the Affinidi Vault
    Website-->>User: Send the Credential Offer claim link to the user <br />with the Transaction Code

Ensure that you present or send the URL to claim the credential offer, including the transaction code if generated securely by the user.

Claim Modes

When creating a credential offer, you must specify the claim mode (claimMode) for how the user retrieves and claims the credential to store it in their Affinidi Vault. If the claim mode is not specified, the TX_CODE is used by default.

Supported claim modes in Credential Issuance:

• TX_CODE generates a transaction code that must be shared securely with the user. The user must enter the generated transaction code to retrieve and claim the credential. When creating a credential offer with TX_CODE as the claim mode, the user’s Decentralised Identifier (DID) is optional.

• FIXED_HOLDER does not generate a transaction code but requires the user’s Decentralised Identifier (DID) when creating the credential offer. The Credential Issuance service will validate if the DID of the current user claiming the credential matches the DID on the credential offer.

  To get the user’s DID, implement  Affinidi Login to authenticate and extract the user’s DID value from the ID Token provided.

Credential Offer Claim Flow

The credential offer is only valid for claims based on the Lifetime of the Credential Offer configured in the Credential Issuance configuration. If the user fails to claim the offer by this time, your application must create a new credential offer.

When the user clicks on the URL you sent to claim the credential offer, it redirects them to their digital wallet (Affinidi Vault). Following the OID4VCI specification, it exchanges the pre-authorisation and transaction code to get the access token required to retrieve the credential details.

sequenceDiagram
    actor User
    participant Affinidi Vault
    participant Credential Issuance Service

    User->>Affinidi Vault: Enters the Transaction Code to view the Credential Offer
    Affinidi Vault->>Credential Issuance Service: Resolves Offer URI and get the Credential Offer with Access Token
    Note over Affinidi Vault, Credential Issuance Service: Affinidi Vault will exchange Trx Code and Pre-Auth Code <br /> for the Access Token to Get the Credential
    Credential Issuance Service->>Credential Issuance Service: Validate credential proof
    Credential Issuance Service->>Credential Issuance Service: Update Credential Offer as Claimed
    Credential Issuance Service->>Affinidi Vault: Return the Verifiable Credential
    Affinidi Vault->>User: Presented the Verifiable Credential
    User->>Affinidi Vault: Accepts the Verifiable Credential
    Affinidi Vault->>Affinidi Vault: Securely Stores the Verifiable Credential

After the user accepts the credential, it is securely stored in their Affinidi Vault, and can be shared later when requested.

Users can claim each credential only once per link. They can duplicate the claimed Verifiable Credential (VC) into different profiles within their Affinidi Vault.

What’s Next