OpenID4VCI is the protocol an issuer uses to deliver a credential into a wallet. It covers the credential offer, holder authorisation, proof of key possession, and issuing the signed credential itself.
Issuance starts with a credential offer, usually a QR code or a link. The wallet fetches issuer metadata, sees which credential types and formats are available, and takes the holder through authorisation. That is either an authorisation code flow where they authenticate with the issuer, or a pre-authorised code flow where that already happened elsewhere.
Before issuing, the issuer asks for proof that the wallet controls the key the credential will be bound to. That is what makes the result device-bound rather than a bearer token somebody can copy out.
Most business integrations use the pre-authorised flow, because the holder has usually just authenticated in your own product and you would rather not ask twice.
Defined in
OpenID Foundation, OpenID4VCI; ARF
If you hold authoritative data about your customers, membership, entitlement, employment, licence status, this is how it becomes a credential they carry and present elsewhere with your name on it.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
