Skip to main content

Present a Credential

The wallet presents credentials to verifiers using the OID4VP 1.0 (OpenID for Verifiable Presentations) protocol. The wallet uses DCQL (Digital Credentials Query Language) to interpret the credential selection criteria the verifier requests.

DCQL, not DIF Presentation Exchange

The ISBE wallet implements OID4VP with DCQL. Verifiers that want to interoperate must issue authorization_request with DCQL queries. The presentation_definition format of DIF Presentation Exchange (PEv2) is not supported.

How the verifier initiates the request​

The verifier generates an authorization request and delivers it to the holder in one of these ways:

  • QR code: the holder scans the QR with the wallet camera.
  • Deep link: the holder taps a link in their browser or in an application. The link scheme is openid4vp://.

Complete flow​

Step by step in the wallet​

  1. Scan the QR — Open the wallet and tap the camera icon, or open the deep link from the browser or a verifier's application.
  2. Review the request — The wallet shows which verifier is requesting the presentation and what attributes or credentials it requests.
  3. Credential selection — If you have multiple credentials meeting the DCQL criteria, the wallet lets you choose which one to present.
  4. Presentation consent — Tap "Share" to confirm that you authorize the send. The wallet shares nothing without explicit confirmation.
  5. Result — The wallet sends the VP to the verifier and shows a send confirmation.
The wallet presents the complete credential

Selective disclosure (sharing only some attributes) is not available in the current implementation. The wallet includes the complete credential in the verifiable presentation.

Verifiable Presentation format​

The wallet builds the VP as a JWT signed with the holder's private key. The response to the verifier has the form:

POST <response_uri>
Content-Type: application/x-www-form-urlencoded

vp_token=eyJhbGciOiJFUzI1NiIsImtpZCI6ImRpZDprZXk6...&
presentation_submission=...

The vp_token is a JWT with the following structure:

{
  "iss": "did:key:z6MkszZtxCmA2Ce4vUV132PCuLQmwnaDD5mw2L23fGNnsiRn",
  "aud": "https://verifier.example.com",
  "nonce": "n-0S6_WzA2Mj",
  "vp": {
    "@context": ["https://www.w3.org/2018/credentials/v1"],
    "type": ["VerifiablePresentation"],
    "verifiableCredential": ["eyJhbGciOiJFUzI1NiIs..."]
  }
}

The iss is the holder's DID (did:key or did:jwk). The aud field is the verifier's identifier as it appears in the authorization_request. The nonce prevents replay attacks and is provided by the verifier in the request.

The response method is always direct_post: the wallet sends the VP directly to the verifier's response_uri via HTTP POST.

For integrators: authorization_request structure​

The verifier must issue an authorization request with DCQL. Example request by reference:

openid4vp://?request_uri=https%3A%2F%2Fverifier.example.com%2Frequest%2Fabc123

The authorization_request object to which request_uri points must include:

{
  "response_type": "vp_token",
  "response_mode": "direct_post",
  "response_uri": "https://verifier.example.com/response",
  "nonce": "n-0S6_WzA2Mj",
  "dcql_query": {
    "credentials": [
      {
        "id": "credential_query_id",
        "format": "jwt_vc_json",
        "claims": [
          {"path": ["$.vc.credentialSubject.nombre"]},
          {"path": ["$.vc.credentialSubject.fechaNacimiento"]}
        ]
      }
    ]
  }
}

The wallet responds with vp_token and presentation_submission at the response_uri.

See the OID4VCI/VP Reference for the detailed OID4VP protocol specification and DCQL format.