OpenID4VCI is the protocol used for verifiable credential issuance. It defines how a wallet requests a credential from an issuer, how client settings are established, and how the resulting credential is delivered in a standardised way that can be integrated across different identity systems.
How OpenID4VCI Works
OpenID4VCI standardises the issuance side of the verifiable credential model. It gives issuers and wallets a common way to negotiate credential delivery, request formats, and proof requirements so that a credential can be issued in a predictable way across ecosystems rather than through bespoke integrations.
This matters because issuance is where trust is first established between the issuer, the wallet, and the eventual credential lifecycle. A consistent protocol reduces one-off implementation drift, but it does not by itself define policy, trust frameworks, or the legal rules that decide whether a credential should be issued.
Wallet-to-Issuer Issuance Flow
At a practical level, OpenID4VCI describes how a wallet initiates a request, how an issuer presents an offer or configuration, and how the issuer returns the credential once the required checks are satisfied. The protocol is designed to support both pre-authorised and interactive issuance patterns, which makes it useful for consumer wallets, enterprise wallets, and digital identity deployments that need interoperable issuance.
The protocol also gives implementers a common vocabulary for client settings and metadata, which lowers integration friction between issuers and wallet software. That interoperability is especially important when the same wallet must work across multiple issuers, credential formats, and relying-party environments.
Protocol Building Blocks and Trust Signals
OpenID4VCI is more than a transport wrapper. It usually sits alongside issuer metadata, credential offers, issuer identification, proof of possession, and wallet authentication or attestation checks. Those building blocks help the issuer decide whether the wallet is entitled to receive the credential and in what format the credential should be delivered.
In practice, the protocol often interoperates with adjacent identity specifications such as OpenID Connect Core 1.0 and broader wallet and verifiable credential guidance. The value of OpenID4VCI is that it standardises the issuance exchange even when the downstream credential type differs, such as a mobile identity, a membership credential, or a business credential.
Why OpenID4VCI Matters for Verifiable Credentials
Because issuance is the point at which a credential enters circulation, OpenID4VCI affects the whole downstream trust chain. If the issuance step is inconsistent, every later verification step inherits ambiguity about format, authenticity, binding, and delivery expectations. Standardisation at this layer helps organisations scale credential programmes without forcing each wallet or issuer pair to invent its own issuance API.
It also helps align issuance with broader digital identity ecosystems. For readers building wallet-based identity journeys, the most useful context is often the relationship between issuance, presentation, selective disclosure, and trust registry assumptions, all of which shape whether a credential can be used safely after it leaves the issuer.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines identity proofing and authenticator assurance that issuance workflows often rely on. |
| Recommendation — Align issuance requirements with the appropriate identity assurance and proofing level before issuing credentials. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers lifecycle handling of authenticators and related secrets used in credential issuance flows. |
| IA-2 — Identification and Authentication (Organizational Users) | Applies when issuer-side users or administrators must authenticate to manage issuance systems. | |
| Recommendation — Protect and rotate any secrets or keys used to issue or bind credentials. Require strong authentication for issuer operators and administrative access to issuance platforms. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 1, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org