Skip to main content

Receive a Credential

The wallet receives credentials from ISBE-accredited issuers using the OID4VCI 1.0 (OpenID for Verifiable Credential Issuance) protocol, exclusively using the pre-authorized code flow.

How the issuer initiates the offer​

The issuer generates a credential offer and delivers it to the holder in one of two ways:

  • QR code: the holder scans the QR with the wallet camera.
  • Deep link: the holder taps a link in their browser or in an application. The link scheme is openid-credential-offer://.

Both forms encode the same message: the credential_offer URL or the offer JSON object directly.

Complete flow​

With transaction code (tx_code)​

If the issuer requires an additional PIN (transaction code), the flow includes an extra step before requesting the token:

  1. The issuer indicates in the offer that a tx_code is required.
  2. The wallet shows a PIN input field.
  3. The holder enters the code (received via SMS, email, or another issuer channel).
  4. The wallet includes the tx_code in the request to the /token endpoint.

Deferred issuance​

Some issuers cannot issue the credential immediately (for example, because they require manual verification). In that case:

  1. The issuer responds with an acceptance_token instead of the credential.
  2. The wallet shows the user that the credential is pending.
  3. The wallet periodically queries the /deferred_credential endpoint with the acceptance_token until the issuer issues the credential.

Step by step in the wallet​

  1. Scan the QR — Open the wallet and tap the camera icon, or open the deep link from your browser.
  2. Review the offer — The wallet shows the type of credential you are about to receive and the issuer. Verify that the issuer is who you expect.
  3. Enter the PIN (if the issuer requires it) — The issuer will have sent you the transaction code via the agreed channel.
  4. Tap "Accept" — The wallet requests the token and credential from the issuer automatically.
  5. Credential saved — The credential appears in your credential list. It is stored encrypted on the device.

Verify a received credential​

You can view a credential's attributes by tapping on it in the list. The wallet shows:

  • The credential type and issuer.
  • The credentialSubject attributes.
  • The issuance date and expiry date (validUntil/exp), if the issuer included them.
Signature validation

The wallet verifies the issuer's signature at the time of reception. It will reject credentials whose signature is invalid or whose issuer cannot be resolved. The wallet does not verify the credential's revocation status (the credentialStatus field is not checked).

Supported format​

The wallet accepts credentials in jwt_vc_json format. It does not accept vc+sd-jwt or ldp_vc. If the issuer offers an unsupported format, the wallet will reject the offer with an error message.

For integrators: credential_offer structure​

The credential_offer object the issuer must generate to be compatible with the ISBE wallet has the following structure:

{
  "credential_issuer": "https://issuer.example.redisbe.com",
  "credentials": ["CredentialTypeName"],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "SplxlOBeZQQYbYS6WxSbIA",
      "tx_code": {
        "length": 6,
        "input_mode": "numeric",
        "description": "Enter the code received via SMS"
      }
    }
  }
}

The tx_code field is optional. If no PIN is required, omit the field entirely.

See the OID4VCI/VP Reference for the detailed endpoint specification.