VC Lab

Three small apps pass a verifiable credential between them over the OpenID standards. An issuer signs your contact details, a web wallet keeps them, and a verifier asks for just the parts it needs. Each app shows every protocol step and the checks behind it.

  1. 1

    Issuer

    OpenID4VCI 1.0

    Enter a full name, email and phone number. The issuer signs them as an SD-JWT VC and offers it to your wallet, with no login needed.

    Open the issuer
  2. 2

    Wallet

    Holder · in your browser

    Accept the credential and it is stored in this browser, bound to a key that never leaves it. Later the wallet asks your consent before sharing anything.

    Open the wallet
  3. 3

    Verifier

    OpenID4VP 1.0 · DCQL

    Choose which details to ask for. You approve in the wallet, and the verifier checks the issuer's signature, each disclosure and the key binding.

    Open the verifier

Try it in one browser

Start at the issuer and follow the buttons: each app sends you on to the next. Use the same browser throughout, because the wallet keeps credentials in that browser's storage. It works on a phone too.

The credential

  • SD-JWT VC, type urn:vc-lab:contact:1, signed with ES256
  • name, email and phone_number, each disclosed on its own
  • Bound to a key the wallet makes for it (cnf.jwk)

Why three addresses

Issuer, wallet and verifier are separate sites, as they would be in real life. The wallet names a verifier by its address, and the browser keeps the wallet's storage apart from the other two.

Standards: OpenID4VCI 1.0, OpenID4VP 1.0, SD-JWT VC. This is a demonstration: the credentials it issues are trusted by nothing outside the lab.