Issuer Configuration

The Universal Issuer supports per-account configuration settings that control how credentials are issued and which schemas are available.

Configuration Setting: `oid4vci`

The oid4vci setting is the central configuration for credential issuance. It defines the credential schemas your account can issue and, optionally, the external Identity Provider used for the authorization code flow.

Get Configuration

bash

curl -X GET "https://profile.godiddy.com/1.0.0/profile/metadata/oid4vci" \
     -H "Authorization: Bearer b082c420-df67-4b06-899c-b7c51d75fba0"

Set Configuration

The following request configures the EU PID (EuPid2023_sd_jwt_dc) credential schema.

bash

curl -X PUT "https://profile.godiddy.com/1.0.0/profile/metadata/oid4vci" \
     -H "Authorization: Bearer b082c420-df67-4b06-899c-b7c51d75fba0" \
     -H "Content-Type: application/json" \
     -d '{
           "credentialConfigurations": {
             "EuPid2023_sd_jwt_dc": {
               "format": "dc+sd-jwt",
               "vct": "urn:eu.europa.ec.eudi:pid:1",
               "issuer": {
                 "kid": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg#zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
                 "id": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
                 "name": "Universal Issuer",
                 "image": "https://uniissuer.io/images/logo.jpg"
               },
               "scope": "urn:eu.europa.ec.eudi:pid:1"
             }
           }
         }'

Credential Schema Configuration

The credentialConfigurations object is a map of credential schemas available to your account. Each key is a schema identifier you choose (e.g. EuPid2023_sd_jwt_dc), and the value is the configuration for that schema.

json

{
  "credentialConfigurations": {
    "ExampleCredentialSchema_1": { },
    "ExampleCredentialSchema_2": { }
  }
}

Each schema configuration supports the following properties:

Property	Type	Required	Description
`format`	String	Yes	Credential format. See Supported Credential Formats.
`context`	Array	Yes	JSON-LD `@context` URIs. Must include the base context for the credential data model version in use.
`type`	Array	Yes	Credential type values. Must include `VerifiableCredential`.
`vct`	String	Yes (SD-JWT only)	Verifiable Credential Type URI for `dc+sd-jwt` and `vc+sd-jwt` credentials.
`issuer`	Object	Yes	Issuer identity and signing key. See Issuer.
`credential_status`	Object	No	Revocation configuration. See Credential Status.
`claims_endpoint`	Object	No	External endpoint to fetch credential claims dynamically after IdP authentication. See Claims Endpoint.

Format

Supported values: jwt_vc_json, ldp_vc, dc+sd-jwt.

Context

The @context array defines the JSON-LD context for the credential. At minimum, include the base context for your credential data model:

VCDM v1: https://www.w3.org/2018/credentials/v1
VCDM v2: https://www.w3.org/ns/credentials/v2

Type

The type array must include VerifiableCredential as well as any domain-specific types for the credential (e.g. Iso18013DriversLicenseCredential).

VCT

For dc+sd-jwt and vc+sd-jwt credentials, vct is a URI that uniquely identifies the credential type. It signals to verifiers which schema and semantics apply to the credential and enables interoperability across systems.

Issuer

The issuer object identifies the credential issuer and the key used to sign credentials.

Property	Required	Description
`id`	Yes	DID of the issuer. Must be a DID registered in the platform. To create a DID, see DID Registration.
`kid`	No	Key ID of the signing key. Must be a key present in the DID Document of `issuer.id`.
`name`	No	Human-readable name of the issuer, displayed in wallets that support it.
`image`	No	Logo URL of the issuer.
`url`	No	Website URL of the issuer.

Credential Status

Configure credential_status to enable revocation tracking for issued credentials. If omitted, issued credentials will not carry a revocation status entry.

Property	Required	Description
`type`	Yes	Status list type. Use `StatusList2021Entry` for VCDM v1 or `BitstringStatusListEntry` for VCDM v2.
`issuerDid`	No	DID of the issuer of the Status List VC. Defaults to the credential issuer DID.
`revocationListId`	No	Name or identifier of the Status List VC to use.
`revocationListLength`	No	Number of entries in the Status List.
`statusPurpose`	No	Purpose of the status entry. Accepted values: `revocation`, `suspension`.

Claims Endpoint

The claims_endpoint enables dynamic claims fetching in the authorization code flow. When configured, you can initialize an issuance request without providing claims upfront — the service fetches them automatically after the user authenticates with the external IdP, using the IdP-issued access token to identify the user.

Property	Type	Default	Required	Description
`url`	String	—	Yes	URL of your claims endpoint.
`method`	String	`GET`	No	HTTP method to use when calling the endpoint. Accepted values: `GET`, `POST`.

How the Service Calls Your Claims Endpoint

After the user successfully authenticates with the external IdP, the service calls your claims endpoint with the following context so it can look up the right claims for the right user and credential type.

Authorization header (both methods):

Authorization: Bearer <idp_access_token>

The IdP access token identifies the authenticated user. Your endpoint should validate this token and use it to look up the user's data.

GET request — context passed as query parameters:

GET {url}?schema={schemaId}&account_id={accountId}&request_id={requestId}

POST request — context passed in the JSON body:

http

POST {url}
Content-Type: application/json

{
  "schema": "EuPid2023_sd_jwt_dc",
  "account_id": "2396f46d-c4cf-4d57-bd2c-bac5274fe1ec",
  "request_id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890"
}

Parameter	Description
`schema`	The credential schema key being issued. Use this to return the correct set of claims for the credential type.
`account_id`	Your account identifier. Useful when a single claims endpoint serves multiple accounts.
`request_id`	The issuance request ID. Use this for end-to-end correlation in your logs and audit trail.

Expected Response

Your endpoint must return 200 OK with a JSON object whose keys and values are the credential claims:

json

{
  "given_name": "Bernd",
  "family_name": "Abt",
  "birth_date": "1962-10-26",
  "issuing_country": "AT",
  "nationality": ["AT"]
}

The returned object is used directly as the credential's claim set. If the endpoint returns a non-2xx status, the issuance is marked as FAILED and the wallet receives an appropriate OAuth error response.

Error Handling

HTTP Status from Your Endpoint	Effect
`200 OK`	Claims are stored and issuance proceeds normally.
`401 Unauthorized` / `403 Forbidden`	Issuance fails with `access_denied`. The `issuanceStatusUrl` reports `FAILED`.
Any other non-2xx	Issuance fails with `temporarily_unavailable`. The `issuanceStatusUrl` reports `FAILED`.
Unreachable / timeout	Issuance fails with `temporarily_unavailable`. The `issuanceStatusUrl` reports `FAILED`.

External IdP Configuration (Authorization Code Flow)

To enable the authorization code flow, include an externalIdp block alongside credentialConfigurations in the oid4vci setting. When configured, the service brokers user authentication through the specified external OIDC Identity Provider before issuing a credential.

Set Configuration with External IdP

The following example enables the authorization code flow with dynamic claims fetching. The schema has a claims_endpoint configured, so no claims need to be provided when initializing an issuance request.

bash

curl -X PUT "https://profile.godiddy.com/1.0.0/profile/metadata/oid4vci" \
     -H "Authorization: Bearer b082c420-df67-4b06-899c-b7c51d75fba0" \
     -H "Content-Type: application/json" \
     -d '{
           "credentialConfigurations": {
             "EuPid2023_sd_jwt_dc": {
               "format": "dc+sd-jwt",
               "vct": "urn:eu.europa.ec.eudi:pid:1",
               "issuer": {
                 "kid": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg#zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
                 "id": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
                 "name": "Universal Issuer"
               },
               "scope": "urn:eu.europa.ec.eudi:pid:1",
               "claims_endpoint": {
                 "url": "https://claims.example.com/api/claims",
                 "method": "POST"
               }
             }
           },
           "externalIdp": {
             "issuer": "https://idp.example.com",
             "client_id": "my-issuer-client-id",
             "client_secret": "my-client-secret",
             "scopes": ["openid", "profile"],
             "use_pkce": true,
             "subject_claim": "sub"
           }
         }'

External IdP Properties

Property	Type	Default	Required	Description
`issuer`	String	—	Yes	OIDC issuer URL of the external IdP. Used for OIDC discovery (`.well-known/openid-configuration`).
`client_id`	String	—	Yes	Client ID registered for this service in the external IdP.
`client_secret`	String	—	No	Client secret associated with `client_id`. Required for confidential clients.
`scopes`	Array	`["openid"]`	No	OAuth scopes to request from the external IdP. Include any scopes needed for your claims endpoint to identify the user.
`use_pkce`	Boolean	`true`	No	Whether to use PKCE when the service redirects to the external IdP. Recommended.
`subject_claim`	String	`"sub"`	No	The claim in the IdP `id_token` used as the verified user subject identifier.

Redirect URI

The service uses a fixed callback URL when redirecting the user to the external IdP. You must register this URL as an allowed redirect URI in your IdP's client settings before the authorization code flow will work.

The redirect URI follows this pattern:

https://oid4vci.example.com/1.0/{accountId}/v1/authorize/callback

The exact URL depends on your account's base URL. Your {accountId} is visible in the Dashboard. The URL may also differ if your setup routes wallet-facing traffic through an API gateway — confirm the correct value with your account details or contact support.

Example:

https://oid4vci.example.com/1.0/2396f46d-c4cf-4d57-bd2c-bac5274fe1ec/v1/authorize/callback

Example Credential Configurations

Full Example Schema (with all options)

json

{
  "credentialConfigurations": {
    "ExampleCredentialSchema": {
      "format": "dc+sd-jwt",
      "context": [
        "https://www.w3.org/2018/credentials/v1",
        "https://www.w3.org/ns/credentials/examples/v2"
      ],
      "type": [
        "VerifiableCredential",
        "ExampleCredential"
      ],
      "vct": "https://example.org/vct/example-credential",
      "issuer": {
        "id": "did:web:example.org",
        "name": "Example Issuer",
        "kid": "did:web:example.org#key-1"
      },
      "credential_status": {
        "type": "StatusList2021Entry",
        "issuerDid": "did:web:example.org",
        "revocationListId": "revocation-list-1",
        "revocationListLength": 10000,
        "statusPurpose": "revocation"
      },
      "claims_endpoint": {
        "url": "https://claims.example.org/api/claims",
        "method": "POST"
      },
      "credential_signing_alg_values_supported": [
        "ES256",
        "ES384",
        "EdDSA",
        "ES256K",
        "PS256"
      ],
      "cryptographic_binding_methods_supported": [
        "did:key",
        "did:web",
        "did:ebsi",
        "did:jwk",
        "did:webvh",
        "jwk"
      ],
      "proof_types_supported": [
        "ES256",
        "ES256K",
        "EdDSA"
      ]
    }
  }
}

1. ISO 18013 Driver's License (JSON-LD)

json

{
  "Iso18013DriversLicenseCredential_ldp_vc": {
    "format": "ldp_vc",
    "context": [
      "https://www.w3.org/2018/credentials/v1",
      "https://w3id.org/vdl/v2",
      "https://w3id.org/vdl/aamva/v1"
    ],
    "type": [
      "VerifiableCredential",
      "Iso18013DriversLicenseCredential"
    ],
    "issuer": {
      "id": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
      "name": "Universal Issuer",
      "image": "https://uniissuer.io/images/logo.jpg",
      "url": "https://dmv.utopia.example/",
      "kid": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg#zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg"
    },
    "credentialStatus": {
      "type": "StatusList2021Entry",
      "issuerDid": "did:key:zDnaeXPwKyi5isPCAfNMj1SG3QDMWYqQFcdCwvvLosQ3zg1mo",
      "revocationListId": "revocation-list",
      "statusPurpose": "revocation",
      "revocationListLength": 100000
    }
  }
}

2. EU PID (SD-JWT)

json

{
  "EuPid2023_sd_jwt_dc": {
    "format": "dc+sd-jwt",
    "vct": "urn:eu.europa.ec.eudi:pid:1",
    "issuer": {
      "kid": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg#zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
      "id": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
      "name": "Universal Issuer",
      "image": "https://uniissuer.io/images/logo.jpg"
    },
    "scope": "urn:eu.europa.ec.eudi:pid:1"
  }
}

3. EU PID (JWT VC)

json

{
  "EuPid2023_jwt_vc_json": {
    "format": "jwt_vc_json",
    "context": [
      "https://www.w3.org/2018/credentials/v1"
    ],
    "type": [
      "VerifiableCredential",
      "EuPid2023"
    ],
    "issuer": {
      "id": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg",
      "name": "Universal Issuer",
      "image": "https://uniissuer.io/images/logo.jpg",
      "kid": "did:key:zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg#zDnaetFfmqyM8dDpQNizCef9k8HGbHKx6d1bnCvV1daqynDPg"
    },
    "scope": "urn:eu.europa.ec.eudi:pid:1"
  }
}

4. Custom Credential Schema

json

{
  "MyCustomCredential_jwt_vc_json": {
    "format": "jwt_vc_json",
    "context": [
      "https://www.w3.org/2018/credentials/v1",
      "https://my-schema.org/v1"
    ],
    "type": [
      "VerifiableCredential",
      "MyCustomCredential"
    ],
    "issuer": {
      "id": "did:key:zMyIssuerKey",
      "name": "My Custom Issuer",
      "image": "https://my-issuer.com/logo.png",
      "kid": "did:key:zMyIssuerKey#zMyIssuerKey"
    },
    "credential_signing_alg_values_supported": [
      "ES256",
      "EdDSA"
    ],
    "cryptographic_binding_methods_supported": [
      "did:key",
      "jwk"
    ],
    "proof_types_supported": [
      "ES256",
      "EdDSA"
    ]
  }
}

Reference

Supported Credential Formats

Format Identifier	Description
`jwt_vc_json`	JWT-based Verifiable Credential (JSON)
`ldp_vc`	JSON-LD Verifiable Credential
`dc+sd-jwt`	SD-JWT Verifiable Credential (data model)

Supported Signing Algorithms

Algorithm	Description
`ES256`	ECDSA with P-256 curve and SHA-256
`ES384`	ECDSA with P-384 curve and SHA-384
`EdDSA`	Ed25519
`ES256K`	ECDSA with secp256k1 curve
`PS256`	RSASSA-PSS with SHA-256

Supported Cryptographic Binding Methods

Method	Description
`did:key`	Decentralized identifier with embedded key
`did:web`	Web-based decentralized identifier
`did:ebsi`	EBSI decentralized identifier
`did:jwk`	JWK-based decentralized identifier
`did:webvh`	Web-based verifiable holder identifier
`jwk`	Raw JSON Web Key

Issuer Configuration ​

Configuration Setting: oid4vci ​

Get Configuration ​

Set Configuration ​

Credential Schema Configuration ​

Format ​

Context ​

Type ​

VCT ​

Issuer ​

Credential Status ​

Claims Endpoint ​

How the Service Calls Your Claims Endpoint ​

Expected Response ​

Error Handling ​

External IdP Configuration (Authorization Code Flow) ​

Set Configuration with External IdP ​

External IdP Properties ​

Redirect URI ​

Example Credential Configurations ​

Full Example Schema (with all options) ​

1. ISO 18013 Driver's License (JSON-LD) ​

2. EU PID (SD-JWT) ​

3. EU PID (JWT VC) ​

4. Custom Credential Schema ​

Reference ​

Supported Credential Formats ​

Supported Signing Algorithms ​

Supported Cryptographic Binding Methods ​

Issuer Configuration

Configuration Setting: `oid4vci`

Get Configuration

Set Configuration

Credential Schema Configuration

Format

Context

Type

VCT

Issuer

Credential Status

Claims Endpoint

How the Service Calls Your Claims Endpoint

Expected Response

Error Handling

External IdP Configuration (Authorization Code Flow)

Set Configuration with External IdP

External IdP Properties

Redirect URI

Example Credential Configurations

Full Example Schema (with all options)

1. ISO 18013 Driver's License (JSON-LD)

2. EU PID (SD-JWT)

3. EU PID (JWT VC)

4. Custom Credential Schema

Reference

Supported Credential Formats

Supported Signing Algorithms

Supported Cryptographic Binding Methods