WACI Protocol

The WACI (Wallet and Credential Interactions) Protocol is an open specification that defines a secure, interoperable method for a verifier (a website or app) to request and receive Verifiable Credentials (VCs) from a user's digital wallet. It standardizes the message flow for credential presentations, ensuring that users maintain control over their data through a consent-driven, user-centric model. The protocol is designed to work across different wallet implementations and credential formats, facilitating DID (Decentralized Identifier)-based interactions without vendor lock-in.

At its core, WACI Protocol operates through a series of defined interaction patterns, most commonly a QR code or deep link initiation. A verifier generates a presentation request, which is encoded into a QR code. The user scans this code with their wallet app, which then displays the specific data being requested. The user consents to share the required credentials, which are cryptographically signed and returned to the verifier. This process enables use cases like age verification without revealing a birthdate or proof of membership without disclosing an entire credential.

The protocol is a crucial component of the broader SSI (Self-Sovereign Identity) stack, often used in conjunction with the DIDComm messaging layer for secure, peer-to-peer communication. It was originally developed within the DIF (Decentralized Identity Foundation) and is now a key part of the CHAPI (Credential Handler API) ecosystem. By providing a standardized handshake for credential exchange, WACI reduces fragmentation and allows developers to build applications that can interact with any compliant wallet, from mobile apps to browser extensions.

Practical implementations of WACI Protocol are emerging in sectors requiring high-trust, privacy-preserving interactions. Examples include event ticketing (proving ticket ownership without transferring a full NFT), decentralized finance (DeFi) KYC (sharing certified identity attributes), and secure access to gated online communities or physical locations. Its design emphasizes selective disclosure, allowing users to share minimal, cryptographically verifiable proofs—such as proving they are over 21—instead of handing over entire documents.

The WACI Protocol is a technical specification whose name is an acronym for Wallet And Credential Interactions. It was developed to standardize the flow of requesting and presenting Verifiable Credentials (VCs) between a holder's digital wallet and a verifier's application, such as a website or service. The protocol's creation was driven by the need for a common, interoperable method to execute the Decentralized Identity (DID) use case known as Credential Issuance, where a user proves control of an identifier and receives a credential, and Credential Presentation, where the user shares that credential to access a service.

Its origins are deeply rooted in the work of the Decentralized Identity Foundation (DIF) and the W3C Verifiable Credentials Data Model. The protocol was formally proposed to create a QR code and deep-link-based interaction pattern that is both user-friendly and secure, avoiding the complexity of manual did: URL exchanges. A key conceptual precursor is the CHAPI (Credential Handler API) model, with WACI refining and productizing these ideas into a specific, implementable sequence of messages passed between parties.

The "Wallet" component of the name signifies the user-centric agent, typically a mobile application, that stores private keys and credentials. "And Credential Interactions" precisely defines the protocol's scope: it does not define how credentials are issued or verified internally, but specifically the messages and steps for the wallet and the relying party to interact. This focus on the interaction layer makes it complementary to, not a replacement for, underlying standards like DIDComm or OpenID for Verifiable Credentials (OIDC4VC).

In practice, WACI is most commonly encountered in its WACI-PEX iteration, where PEX stands for Presentation Exchange. This version leverages the DIF Presentation Exchange specification to enable a verifier to make detailed, machine-readable requests for specific credentials and their claims. The protocol's design emphasizes user agency and selective disclosure, ensuring the holder always consents to what is being shared. Its etymology, therefore, serves as a permanent reminder of its foundational goal: to structure the critical handshake between a user's wallet and the digital world's demand for verifiable data.

The WACI (Wallet And Credential Interactions) Protocol is a standardized method for a Verifier to request and receive a Verifiable Credential (VC) from a Holder's digital wallet. The protocol defines a specific sequence of messages exchanged over DIDComm or other secure channels, beginning with a Presentation Request and culminating in a Verifiable Presentation. This structured flow ensures interoperability between different wallet and issuer implementations, allowing users to prove specific claims—like age or membership—without revealing their entire identity or credential.

The protocol operates through a QR code or deep link initiation. A Verifier, such as a website or service, generates a QR code containing a signed Presentation Request. When the Holder scans this code with their compatible wallet, the wallet decodes the request, which specifies the exact type of credential needed and the claims to be disclosed. The wallet then presents this request to the user, who can review and select which credentials from their wallet satisfy the requirements, maintaining user consent as a central tenet.

Following user approval, the Holder's wallet constructs a Verifiable Presentation. This is a cryptographically signed package containing the relevant credentials or derived proofs, often using Selective Disclosure techniques like BBS+ signatures to minimize data exposure. The presentation is sent back to the Verifier, who cryptographically verifies the signatures against the Decentralized Identifiers (DIDs) of both the Holder and the original Issuer. This process establishes trust without needing to contact the Issuer directly, enabling peer-to-peer verification.

Key to WACI's design is its interoperability layer, which sits atop existing SSI (Self-Sovereign Identity) standards like W3C Verifiable Credentials and DIDComm. It does not define new credential formats but specifies how to use them in a predictable, secure exchange. The protocol also supports Challenge-Response mechanisms to prevent replay attacks, where the Verifier includes a unique nonce in the initial request that must be signed in the final presentation.