Credential Offer

A Credential Offer is a machine-readable message, often formatted as a JSON object, that an issuer sends to a prospective holder. It serves as a formal invitation for the holder to request and receive a specific Verifiable Credential (VC). The offer contains essential metadata, such as the credential type, the issuer's identity, and the cryptographic mechanisms that will be used for issuance. This structured proposal is a foundational step in the W3C Verifiable Credentials data model, enabling a standardized, interoperable flow for credential exchange.

The core purpose of a Credential Offer is to establish a secure and consent-based issuance protocol. It allows the holder to review the terms of the credential—what data will be attested, by whom, and under which cryptographic proofs—before proceeding. This process typically involves the holder's wallet or agent software receiving the offer, parsing its contents, and presenting the details to the user for approval. Only after the holder accepts the offer and provides any necessary proofs (like a DID or cryptographic challenge) does the issuer generate and transmit the final, signed Verifiable Credential.

In practical implementations, such as those using OpenID for Verifiable Credential Issuance (OID4VCI), the Credential Offer often contains a unique pre-authorized code or a URL. This code is exchanged with the issuer's credential endpoint to fetch the actual credential data. This mechanism ensures that the credential is issued only to the intended recipient who received the offer, enhancing security and preventing credential interception. The offer acts as the secure handshake that bridges the initial intent to issue with the final cryptographic act of signing and delivering the credential.

A Credential Offer is a structured message, often formatted as a JSON object, sent from an issuer to a prospective holder. It contains the essential metadata required for the holder to understand and potentially accept the credential. This includes the credential type (e.g., UniversityDegreeCredential), the issuer's DID (Decentralized Identifier), a preview of the claims (like name or issuance date), and the specific protocols and endpoints the issuer supports for the subsequent issuance flow. The offer acts as a formal, machine-readable invitation to begin the credential issuance process.

Upon receiving the offer, the holder's wallet or agent software presents the details to the user. The holder reviews the proposed credential's contents, verifies the issuer's identity by resolving their DID, and decides whether to accept. If accepted, the holder typically responds by sending a Credential Request back to the issuer. This request proves the holder controls the DID specified in the offer and formally asks for the credential to be issued. This request-response pattern ensures both parties are in agreement before any sensitive data is transmitted.

The technical foundation for this exchange is often defined by specifications like OpenID for Verifiable Credential Issuance (OIDC4VCI) or W3C Verifiable Credentials API. These standards ensure interoperability between different issuers and wallets. For example, in OIDC4VCI, the Credential Offer can be conveyed via a QR code, a deep link, or a direct message. The offer contains a unique grant that the holder uses to fetch the actual credential from the issuer's server, completing the issuance ceremony. This mechanism is fundamental to user-centric identity, giving individuals agency over which credentials they collect and store.

A Credential Offer is a machine-readable message, typically formatted as a JSON object, sent by an issuer to a prospective holder. Its primary function is to communicate the intent to issue a specific credential and provide the holder with the necessary information to begin the issuance protocol, such as the credential type, the issuer's public DID, and a unique pre-authorized code. This object acts as the formal invitation in issuance flows defined by standards like OpenID for Verifiable Credential Issuance (OID4VCI).

The core components of a Credential Offer include the credential_issuer identifier (the issuer's DID), the credential_configuration_ids specifying which credential types are being offered, and often a grants object detailing the authorization method, such as a pre-authorized code. This code is a one-time token that allows the holder to subsequently request the credential without further interactive authentication, streamlining the user experience. The offer may also contain human-readable metadata like display properties for wallets.

Upon receiving a Credential Offer, a wallet or holder agent parses the object to understand what is being offered and how to proceed. The holder then typically uses the information within the offer to construct a Credential Request, which is sent back to the issuer's endpoint. This request-response pattern ensures that the issuance process is consent-based and that the holder is in control of initiating the final data transfer, a key principle of Self-Sovereign Identity (SSI) architectures.

In practical deployment, Credential Offers can be delivered through various channels: embedded as deep links in QR codes, transmitted via secure messaging protocols, or presented within web applications. For example, a university's student portal might generate a QR code containing a Credential Offer for a digital diploma, which a graduate can then scan with their wallet to begin the issuance process. This flexibility makes the Credential Offer a versatile and user-centric entry point for credential acquisition.