Package-level declarations
Types
Creates proofs of the attestation proof type (OpenID4VCI 1.0, Appendix F.3): exactly one key attestation in JWT format (Appendix D.1), loaded with loadKeyAttestation, without a proof of possession of the attested keys. The c_nonce is passed to loadKeyAttestation as KeyAttestationInput.clientNonce, as it has to be the nonce of the key attestation if the issuer has a Nonce Endpoint (Appendix F.3).
Provides generation and single-use validation of short-lived codes, e.g. authorization codes, pre-authorized codes, or issuer_state values.
Provide authentication and authorization for credential issuance.
Provides the actual data of the user as a credential that shall be issued
Input for CredentialDataProviderFun to resolve the actual data of the user:
Gets parsed from the credential issuer's metadata, essentially an entry from IssuerMetadata.supportedCredentialConfigurations
Defines mapping of CredentialScheme to identifiers used in OID4VCI in OpenId4VciServer (keys in at.asitplus.openid.IssuerMetadata.supportedCredentialConfigurations, and SupportedCredentialFormat.scope) and CredentialAuthorizationServiceStrategy (in at.asitplus.openid.OpenIdAuthorizationDetails.credentialConfigurationId).
Holds valid codes in memory, delegating to nonceService, i.e. entries are protected with a mutex and expire after the lifetime of that service.
Server implementation to handle credential request decryption and credential response encryption using OID4VCI.
Creates proofs of the jwt proof type (OpenID4VCI 1.0, Appendix F.1): a JWT of type openid4vci-proof+jwt, signed with keyMaterial, the key the issued credential will be bound to, which the header references as jwk or kid, see selectProofJwtKeyBinding. Its payload carries the client_id as iss, the Credential Issuer Identifier as aud, the c_nonce as nonce, and as iat the time of clock three minutes ago, to tolerate the clock skew of the issuer.
The metadata of a credential issuer, as it serves them (OpenID4VCI 1.0, 12.2.2): signed and validated, or unsigned, see OpenId4VciProtocolClient.loadIssuerMetadata.
Used in OID4VCI by OpenId4VciServer to obtain user data when issuing credentials using OID4VCI.
OAuth2/OIDC error representation for issuer and wallet flows. Use to model protocol errors and serialize them for responses.
Interface used in at.asitplus.wallet.lib.oauth2.AuthorizationService to actually load user data during the OAuth 2.0 flow, after an authn request (see AuthenticationRequestParameters) has been validated.
Client service to retrieve credentials using OID4VCI
Implements the client side of OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16, without sending any HTTP request itself: every call returns an HttpExchange, whose requests the caller sends with any HTTP stack. The KDoc of each method lists the ProtocolRequests its exchange sends.
Server implementation to issue credentials using OID4VCI.
Creates the proofs of a credential request (OpenID4VCI 1.0, 8.2) of one proof type (Appendix F), which provide the key material the issued credential will be bound to (8.1).
The validation of every proof of a credential request, see ProofValidator.validateProofs.
The report of one proof, see JwtProofChecks and KeyAttestationChecks, and the keys to bind credentials to, if it has been accepted.
Validates the proofs of possession in credential requests of OID4VCI, see validateProofs.
A credential of a credential response, see OpenId4VciClient.decodeCredentialResponse. It has not been validated: pass it to prepareCredentialStorage, which validates it with the holder's key and validator.
Wallet implementation to handle credential request encryption and credential response decryption using OID4VCI.
Functions
Returns true if the other authorization detail is semantically the same, i.e., it has the same OpenIdAuthorizationDetails.credentialConfigurationId.
Converts the result of the credential endpoint to its response: status 200 with the credential response as application/json, or encrypted as application/jwt (OID4VCI 1.0 8.3, 10.), and Cache-Control: no-store, as in every credential response example of OID4VCI 1.0, since it contains credentials.
Converts the result of the nonce endpoint to its response: status 200 with the nonce as JSON, Cache-Control: no-store (OID4VCI 1.0 7.2), and the header DPoP-Nonce, if present (RFC 9449 8.2).