OpenID for Verifiable Presentations (OID4VP)

A core privacy feature allowing users to share only the specific data a verifier needs, rather than an entire credential. For example, proving you are over 21 by revealing only your birth year from a digital ID, not your full name or address. This minimizes data exposure and enhances user control.

Ensures the verifiable presentation is cryptographically bound to the holder who presents it, preventing unauthorized use or replay attacks. This is typically achieved using Decentralized Identifiers (DIDs) and digital signatures, providing strong proof that the credential belongs to the presenter and creating a non-repudiable audit trail.

OID4VP is built on top of established W3C standards, ensuring compatibility across different ecosystems. It leverages:

• Verifiable Credentials (VCs) as the data model.
• Decentralized Identifiers (DIDs) for issuer and holder identification.
• JSON Web Tokens (JWTs) or JSON-LD Proofs for cryptographic proof formats. This standards-based approach prevents vendor lock-in.

The protocol is designed to work with digital identity wallets (mobile apps or browser extensions). The wallet acts as the user's agent, securely storing credentials, managing cryptographic keys, and mediating the presentation flow with the verifier. This creates a consistent, user-centric interface for managing digital identity across services.

Defines a standardized machine-readable format for a Presentation Request. A verifier (e.g., a financial service) sends this request specifying the required credentials and constraints (e.g., "a government-issued ID issued after 2020"). The user's wallet processes this request and returns a Verifiable Presentation in a defined response format.

A core feature of OID4VP is allowing users to share only the specific attributes required. For example, to prove residency in a specific country, a user can present a cryptographically verifiable proof derived from their passport credential that only confirms "country of residence = Germany," without revealing their full name, passport number, or date of birth.

Financial institutions and regulated platforms can use OID4VP to streamline Know Your Customer (KYC) processes. A user can present a verifiable credential issued by a trusted KYC provider. The platform verifies its authenticity and validity instantly, reducing manual checks while maintaining a high assurance level and audit trail.

Services can gate access based on proven qualifications or memberships. Examples include:

• A professional forum requiring a verifiable credential of a software engineering degree.
• A discount platform requiring proof of student status.
• A DAO requiring proof of holding a specific NFT or governance token as a verifiable credential.

OID4VP, built on W3C Verifiable Credentials standards, enables credentials issued by one organization (e.g., a European university) to be seamlessly verified by another (e.g., an Asian employer). This solves interoperability challenges in digital identity, creating a trust framework that is not locked into a single vendor or jurisdiction.

A core privacy feature allowing a holder to share only specific, necessary attributes from a Verifiable Credential.

• Example: Proving you are over 21 by revealing only your birth year from a driver's license credential, without disclosing your full name or address.
• This minimizes data exposure and adheres to the data minimization principle.

The Verifier (relying party) sends a machine-readable Presentation Definition specifying exactly what data is required and the proof formats accepted. The Holder's wallet evaluates this request and constructs a compliant Verifiable Presentation. This structured exchange prevents ambiguous or overreaching data requests.

OID4VP ensures the presented credential is bound to the presenter. The Verifiable Presentation is cryptographically signed by the Holder's private key, providing proof of possession and creating non-repudiable evidence that this specific individual presented the claims. This prevents credential theft and replay attacks.

OID4VP typically uses Decentralized Identifiers (DIDs) as the cryptographic foundation for Holders, Issuers, and Verifiers. DIDs are controlled by the subject via private keys, eliminating reliance on centralized identity providers and reducing single points of failure or correlation.

The Holder must authenticate the Verifier before releasing any data. This is often done by verifying the Verifier's own DID and ensuring it is trusted (e.g., listed on a trusted registry). This mutual authentication prevents phishing and data leakage to malicious parties.

The cryptographic proofs in a Verifiable Presentation create a clear, tamper-evident audit trail. Verifiers can cryptographically verify the credential's issuer signature, its status (not revoked), and the holder's binding signature. This supports regulatory compliance (e.g., GDPR, eIDAS) by providing evidence of consent and data provenance.

The foundational data model for OID4VP. A Verifiable Credential is a tamper-evident digital credential with a cryptographically verifiable authorship. It contains claims (e.g., name, age, membership status) issued by an issuer and can be presented by a holder to a verifier. OID4VP defines the protocol for presenting these VCs.

The core identifier system used in OID4VP. A Decentralized Identifier (DID) is a globally unique, cryptographically verifiable identifier that is controlled by the identity owner (e.g., did:key:z6Mk...). It is not reliant on a central registry. In OID4VP, DIDs are used to identify the holder, issuer, and verifier, enabling trust without a central authority.

The authentication protocol OID4VP extends. OpenID Connect is a widely adopted identity layer built on OAuth 2.0, used for federated login (e.g., "Sign in with Google"). OID4VP reuses OIDC's flows and message structures but replaces the standard ID Token with a Verifiable Presentation, enabling credential-based authentication instead of simple attribute sharing.

A key OIDC profile integrated into OID4VP. SIOPv2 allows an end-user to act as their own OpenID Provider using a DID, eliminating the need for a traditional identity provider. In OID4VP, the holder's wallet implements SIOPv2, allowing it to directly authenticate to a relying party and present VCs, ensuring user-centric data control.

The formal query that initiates an OID4VP flow. A Verifiable Presentation Request is a structured data object (often a JSON object) sent by a verifier (relying party) to a holder's wallet. It specifies the required credentials, constraints (like issuance date), and the presentation definition outlining the proof formats and submission requirements.