-
Notifications
You must be signed in to change notification settings - Fork 35
Description
https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#section-5.9.3
origin: This reserved Client Identifier Prefix is defined in Appendix A.2. The Wallet MUST NOT accept this Client Identifier Prefix in requests. In OpenID4VP over the Digital Credentials API, the audience of the Credential Presentation is always the origin value prefixed by origin:, for example origin:https://verifier.example.com/.
The last component of an origin is an optional port. There should be no trailing slash.
The example origin should be https://verifier.example.com.
Other instances in the spec:
https://openid.net/specs/openid-4-verifiable-presentations-1_0.html#appendix-A.4
The audience for the response (for example, the aud value in a Key Binding JWT) MUST be the Origin, prefixed with origin:, for example origin:https://verifier.example.com/. This is the case even for signed requests. Therefore, when using OpenID4VP over the DC API, the Client Identifier is not used as the audience for the response.