OpenID4VP is the protocol a relying party uses to ask a wallet for credentials and get a signed presentation back. The ARF requires it for remote presentation, profiled by HAIP. It runs over two transmission mechanisms, a custom URI scheme or the W3C Digital Credentials API. Proximity flows, where both devices are physically present, use ISO/IEC 18013-5 instead.
The verifier builds a request saying which credentials and which claims it needs, then delivers it as a QR code for cross-device or a deep link for same-device. The wallet shows the holder exactly what is being asked, and on approval returns a presentation signed with a key tied to their device.
The request uses DCQL, the query language defined in OpenID4VP 1.0. The ARF does not specify a query language of its own, it points at OpenID4VP and HAIP and DCQL arrives with them. The response includes the disclosed claims and the issuer signature over them, so you validate the issuer rather than trusting the wallet.
The protocol carries a nonce tying the presentation to this specific request, which is what stops a captured presentation being replayed somewhere else.
It is not the only protocol here. In-person flows run over ISO/IEC 18013-5, and there is a second remote protocol, ISO/IEC 18013-7, which carries mdoc requests and responses over the internet. Wallets support all of them, so what you implement is a scoping decision rather than a compatibility one.
Defined in
OpenID4VP 1.0 (Final, 9 July 2025); OpenID4VC High Assurance Interoperability Profile; ARF v3.0.0 section 5.7.4
Every relying party integration touches this one. Learn cross-device versus same-device before anything else.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
