Authbound Logo DarkAuthbound
Integration guide

How to integrate the EUDI Wallet

A practical guide for relying parties: what to register, how to request data from a wallet, which checks make the result trustworthy, and what to do for users who do not have a wallet yet.

Reviewed 7 October 2026 against eIDAS 2.0, its implementing acts and the ARF.

Six steps

From first request to verified result

  1. Step 01

    Decide what you need to ask for

    List the attributes your legal obligation or business process actually requires, and nothing more. Ask for derived attributes such as age_over_18 instead of a birth date where they meet the need. This list becomes both your request and your registration.

  2. Step 02

    Register as a relying party

    Register in the member state where you are established, declaring who you are, why you request data and which attributes. You then identify yourself to wallets with an access certificate, and you may not request more than you registered. National registers are still being set up, so start this early.

  3. Step 03

    Send the presentation request

    Remote requests use OpenID4VP, with a DCQL query naming the credentials and claims. Show a QR code when the user is on a desktop and a deep link when they are on their phone. Browsers are adding the Digital Credentials API as another way to reach the wallet.

  4. Step 04

    Verify the response

    Check the issuer signature against the trusted lists, check revocation through the issuer’s status list, confirm device binding, and confirm the response answers your request and not a replayed one. Wallets present either SD-JWT VC or mdoc, so a verifier needs to handle both.

  5. Step 05

    Use the result and keep little

    Feed the verified attributes into your own process, such as onboarding, an age gate or a booking, and keep only what your obligation requires. The wallet shows users who they shared data with, and they can ask you to erase it.

  6. Step 06

    Keep a path for users without a wallet

    Wallets roll out country by country and adoption takes time. Offer the wallet as the fast path and keep your existing method for everyone else, branching on a failed, canceled or expired verification instead of stalling.

Build or buy

What building it yourself involves

If you build it, you maintain

  • OpenID4VP and the EU interoperability profiles, kept current as the ARF moves
  • Both credential formats, SD-JWT VC and mdoc
  • Trusted list and status list retrieval, parsing and refresh
  • QR and deep link handoff on every device
  • Registration, access certificates and their renewal

With Authbound

Authbound creates the wallet request, shows the QR code or deep link, verifies the presentation including issuer trust, revocation and device binding, and sends your backend a structured result. For issuers, it creates OpenID4VCI credential offers from your records.

const verification = await authbound.verifications.create({
  policyId: 'pol_…',      // the claims you registered for
  customerUserRef: user.id,
});

Verification docs →Issuance docs →Use cases →

Registration and data minimisation stay your responsibility whichever route you choose.

Questions

Integration questions

Is there an official EUDI Wallet API?
There is no central EU API. Each certified wallet speaks the same open protocols, OpenID4VP for presentation and OpenID4VCI for issuance, so a relying party integrates with the protocol rather than with each wallet. Providers such as Authbound wrap those protocols in a REST API and SDKs.
Do we integrate each country’s wallet separately?
No. Certified wallets interoperate on common protocols and are checked against common trust lists, so one integration covers wallets from every member state. What still varies by country is when each wallet launches.
Can a provider integrate for us?
Yes. eIDAS 2.0 recognises intermediaries that interact with wallets on behalf of relying parties. An intermediary is treated as a relying party itself and may not store data about the content of the transaction, and your own obligations as a relying party remain.
When do we have to accept the wallet?
Private services required by law or contract to use strong user authentication, and very large online platforms, must accept it from 24 December 2027 when the user asks. Public sector bodies that use electronic identification have to accept it too.

When do wallets launch where you operate? See the EUDI Wallet timeline and rollout by country.