vck-openid/at.asitplus.wallet.lib.oidvci/OpenId4VciServer

OpenId4VciServer

class OpenId4VciServer @JvmOverloads constructor(statusListTokenResolver: StatusListTokenResolver? = null, authorizationService: OAuth2AuthorizationServerAdapter, issuer: Issuer, keyMaterial: Set<KeyMaterial> = setOf(issuer.keyMaterial), cryptoAlgorithms: Set<SignatureAlgorithm> = keyMaterial.map { it.signatureAlgorithm }.toSet(), credentialSchemes: Set<CredentialScheme>, publicContext: String = "https://wallet.a-sit.at/credential-issuer", credentialEndpointPath: String = "/credential", nonceEndpointPath: String = "/nonce", requireKeyAttestation: Boolean = false, proofValidator: ProofValidator = ProofValidator( publicContext = publicContext, requireKeyAttestation = requireKeyAttestation, keyAttestationValidator = KeyAttestationValidator(statusValidator = StatusValidator(statusListTokenResolver)), ), signMetadata: SignJwtFun<IssuerMetadata> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), encryptionService: IssuerEncryptionService = IssuerEncryptionService(), credentialSchemeMapper: CredentialSchemeMapper = DefaultCredentialSchemeMapper(), preferredClientStatusPeriod: Duration? = 31.days, displayProperties: Set<DisplayProperties>? = null, clock: Clock = Clock.System, issuerInfo: List<IssuerInfo>? = null)(source)

Server implementation to issue credentials using OID4VCI.

Implemented from OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16.

Constructors

OpenId4VciServer

@JvmOverloads

constructor(statusListTokenResolver: StatusListTokenResolver? = null, authorizationService: OAuth2AuthorizationServerAdapter, issuer: Issuer, keyMaterial: Set<KeyMaterial> = setOf(issuer.keyMaterial), cryptoAlgorithms: Set<SignatureAlgorithm> = keyMaterial.map { it.signatureAlgorithm }.toSet(), credentialSchemes: Set<CredentialScheme>, publicContext: String = "https://wallet.a-sit.at/credential-issuer", credentialEndpointPath: String = "/credential", nonceEndpointPath: String = "/nonce", requireKeyAttestation: Boolean = false, proofValidator: ProofValidator = ProofValidator( publicContext = publicContext, requireKeyAttestation = requireKeyAttestation, keyAttestationValidator = KeyAttestationValidator(statusValidator = StatusValidator(statusListTokenResolver)), ), signMetadata: SignJwtFun<IssuerMetadata> = SignJwt(EphemeralKeyWithoutCert(), JwsHeaderCertOrJwk()), encryptionService: IssuerEncryptionService = IssuerEncryptionService(), credentialSchemeMapper: CredentialSchemeMapper = DefaultCredentialSchemeMapper(), preferredClientStatusPeriod: Duration? = 31.days, displayProperties: Set<DisplayProperties>? = null, clock: Clock = Clock.System, issuerInfo: List<IssuerInfo>? = null)

Types

CredentialResponse

sealed interface CredentialResponse

Send it converted with toHttpResponse.

Nonce

data class Nonce(val response: ClientNonceResponse, val dpopNonce: String? = null)

Send it converted with toHttpResponse, which sends response as the JSON-serialized body, and dpopNonce in HTTP header DPoP-Nonce when present.

Properties

jwtVcMetadata

val jwtVcMetadata: JwtVcIssuerMetadata

Metadata about the credential issuer in SD-JWT VC

metadata

val metadata: IssuerMetadata

The metadata of this credential issuer, to be served with metadataHttpResponse, which selects between this and signedMetadata.

Functions

credential

suspend fun credential(authorizationHeader: String, params: OpenId4VciClient.CredentialRequest, credentialDataProvider: CredentialDataProviderFun, request: RequestInfo? = null): KmmResult<OpenId4VciServer.CredentialResponse>

Verifies the authorizationHeader to contain a token from authorizationService, verifies the proof sent by the client (must contain a nonce sent from authorizationService), and issues credentials to the client by calling credentialDataProvider.

metadataHttpResponse

suspend fun metadataHttpResponse(acceptHeader: String?): KmmResult<PreparedHttpResponse>

The response to serve at the path formed by inserting the string /.well-known/openid-credential-issuer (see OpenIdConstants.WellKnownPaths.CredentialIssuer) into the Credential Issuer Identifier between the host component and the path component, if any: status 200 with signedMetadata as application/jwt when the request's Accept header acceptHeader lists application/jwt with a quality not below the one of application/json, else metadata as application/json (OID4VCI 1.0 12.2.2). The header Vary: Accept tells caches about this selection (RFC 9110 12.5.5).

nonceWithDpopNonce

suspend fun nonceWithDpopNonce(): KmmResult<OpenId4VciServer.Nonce>

Provides a fresh nonce for credential proofs and a DPoP nonce for DPoP proofs. Requests from the client are HTTP POST. Send the result converted with toHttpResponse.

signedMetadata

suspend fun signedMetadata(): KmmResult<JwsCompactTyped<IssuerMetadata>>

The signed metadata of this credential issuer, to be served with metadataHttpResponse, which selects between this and metadata.