vck-openid/at.asitplus.wallet.lib.oidvci/WalletService

WalletService

class WalletService @JvmOverloads constructor(val clientId: String = "https://wallet.a-sit.at/app", keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, encryptionService: WalletEncryptionService = WalletEncryptionService(), loadKeyAttestation: suspend (WalletService.KeyAttestationInput) -> KmmResult<JwsCompactTyped<KeyAttestationJwt>>? = null, selectProofJwtKeyBinding: suspend (KeyMaterial) -> Pair<JsonWebKey?, String?> = { key -> Pair(key.jsonWebKey, null) })(source)

Client service to retrieve credentials using OID4VCI

Implemented from OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16.

Constructors

WalletService

@JvmOverloads

constructor(clientId: String = "https://wallet.a-sit.at/app", keyMaterial: KeyMaterial = EphemeralKeyWithoutCert(), remoteResourceRetriever: RemoteResourceRetrieverFunction = { null }, encryptionService: WalletEncryptionService = WalletEncryptionService(), loadKeyAttestation: suspend (WalletService.KeyAttestationInput) -> KmmResult<JwsCompactTyped<KeyAttestationJwt>>? = null, selectProofJwtKeyBinding: suspend (KeyMaterial) -> Pair<JsonWebKey?, String?> = { key -> Pair(key.jsonWebKey, null) })

Types

CredentialRequest

sealed interface CredentialRequest

KeyAttestationInput

data class KeyAttestationInput(val credentialIssuer: String?, val clientNonce: String?, val supportedAlgorithms: Collection<String>?, val preferredKeyStorageStatusPeriod: Duration?)

RequestOptions

data class RequestOptions @JvmOverloads constructor(val credentialScheme: CredentialScheme, val representation: CredentialRepresentation = PLAIN_JWT, val state: String = uuid4().toString())

Properties

clientId

val clientId: String

Used as the issuer in credential proofs. Must match the client_id of the OAuth client.

Functions

buildAuthorizationDetails

fun buildAuthorizationDetails(credentialConfigurationId: String, authorizationServers: Set<String>? = null): Set<OpenIdAuthorizationDetails>

fun buildAuthorizationDetails(credentialConfigurationIds: Set<String>, authorizationServers: Set<String>? = null): Set<OpenIdAuthorizationDetails>

Build authorization details for use in OAuth2Client.createAuthRequest.

createCredential

suspend fun createCredential(tokenResponse: TokenResponseParameters, metadata: IssuerMetadata, credentialFormat: SupportedCredentialFormat, clientNonce: String? = null, previouslyRequestedScope: String? = null, clock: Clock = Clock.System): KmmResult<Collection<WalletService.CredentialRequest>>

Creates the credential request to be sent to the credential issuer. Also send along the TokenResponseParameters.accessToken from the token response in HTTP header Authorization see TokenResponseParameters.toHttpHeaderValue. Be sure to include a DPoP header if TokenResponseParameters.tokenType is DPoP, see BuildDPoPHeader. For sample ktor code see OpenId4VciClient in vck-openid-ktor.

parseCredentialOffer

suspend fun parseCredentialOffer(input: String): KmmResult<CredentialOffer>

Parses input as either a JSON-encoded CredentialOffer or a credential offer URL.

parseCredentialResponse

suspend fun parseCredentialResponse(response: CredentialIssuer.CredentialResponse, representation: CredentialRepresentation, scheme: CredentialScheme): KmmResult<Collection<Holder.StoreCredentialInput>>

suspend fun parseCredentialResponse(response: String, isEncrypted: Boolean, representation: CredentialRepresentation, scheme: CredentialScheme): KmmResult<Collection<Holder.StoreCredentialInput>>

Parses response received from the credential issuer, mapping to Holder.StoreCredentialInput, rejecting encrypted responses because they require the originating CredentialRequest.

suspend fun parseCredentialResponse(response: CredentialIssuer.CredentialResponse, request: WalletService.CredentialRequest, representation: CredentialRepresentation, scheme: CredentialScheme): KmmResult<Collection<Holder.StoreCredentialInput>>

suspend fun parseCredentialResponse(response: String, isEncrypted: Boolean, request: WalletService.CredentialRequest, representation: CredentialRepresentation, scheme: CredentialScheme): KmmResult<Collection<Holder.StoreCredentialInput>>

Parses a response and binds its encryption to the exact request that caused it.

selectSupportedCredentialFormat

fun selectSupportedCredentialFormat(requestOptions: WalletService.RequestOptions, metadata: IssuerMetadata): SupportedCredentialFormat?

Extract SupportedCredentialFormat from metadata by filtering according to requestOptions.