Credential Issuance

Issuing verifiable credentials (such as mobile driver's licenses (mDLs), employee badges, health cards, or proof-of-age tokens) means orchestrating identity verification, data sourcing, cryptographic signing, and secure delivery to the holder's device. This section leads you through that journey step by step, then links to the detailed guide for each part.

How credential issuance works

Credential issuance involves three parties:

1. Issuer: Your organization, using MATTR VII to create and sign credentials.
2. Holder: The end user who receives and holds the credential on their device.
3. Credential Holder App (digital wallet app): The app on the holder's device that claims, stores, and later presents the credential. This guide refers to it as the Holder app.

The result is a credential that is tamper-evident (any change invalidates the signature), verifiable (any relying party can confirm authenticity against the issuer's certificate chain without contacting the issuer), device-bound (held on the holder's own device and usable without an internet connection), and revocable (status can be updated after issuance).

Why OID4VCI

MATTR VII issues credentials using OpenID for Verifiable Credential Issuance (OID4VCI), an open standard from the OpenID Foundation built on OAuth 2.0. Leading with a standard rather than a bespoke integration gives you:

• Interoperability: One issuance integration that works across many compliant wallets.
• Choice for holders: Holders pick the wallet that suits them.
• Lower integration cost: No separate code path per wallet provider.
• Standards alignment: Aligned with ecosystem direction such as the European Digital Identity Wallet (EUDI) framework.

Most issuance flows deliver mDocs (aligned with ISO/IEC 18013-5), the format MATTR leads with. CWT credentials are also supported, primarily for digital pass and PDF use cases.

What you will set up

Before diving in, here is what building an issuance solution involves. You can follow the steps in order or jump ahead to any part:

• Set up the PKI and signing certificates that sign your credentials, then create those certificates.
• Create a credential configuration that defines what data the credential carries and how it appears.
• Connect a claims source so claims are populated for the authenticated user at issuance time.
• Integrate the credential offer into your flow.
• Have MATTR VII issue the credential to the Holder app.

The issuance journey at a glance

At a high level, every OID4VCI flow follows three moves: the issuer prepares an offer, the issuer authenticates and authorizes the holder to claim it (the issuer controls what a holder is allowed to claim), and the issuer issues a signed credential to the Holder app. The steps below expand that into a build sequence.

Set up your issuance

Deliver and issue

How to build it

You can build and operate an OID4VCI issuance flow through two complementary surfaces:

• MATTR Portal: A web interface for managing your MATTR VII tenants. Create credential configurations, manage claims sources, configure issuance flows, and monitor activity without writing code. See the MATTR Portal documentation.
• MATTR VII API: A REST API for full programmatic control over every aspect of issuance. Use it to embed issuance into your own systems or automate at scale.

Finding your way around

Each feature has a set of pages, and the type of page tells you what to expect:

• Quickstart: For assessing the capability. It gets a solution working end-to-end as fast as possible, without building everything or covering every option.
• Tutorial: For learning how to do it while doing it. It walks you through the process step by step and adds context along the way.
• Guide: For users who already know the outcome they want. It gives a direct path to a specific, usually isolated, task.

Where to go next

• Already issuing? See Managing issued credentials for revocation, refresh, and reporting.
• Not using OID4VCI? Direct Issuance is a supported alternative for issuing CWT credentials directly.
• Have a question? See the Issuance FAQ.