Credential Issuance

Issuing verifiable credentials (such as mobile driver's licenses (mDLs), employee badges, health cards, or proof-of-age tokens) requires orchestrating identity verification, data sourcing, cryptographic signing, and secure delivery to a holder's wallet. As an implementer, you need to understand the components involved and how they fit together within your existing systems.

This overview walks you through the key architectural decisions for building a credential issuance solution using MATTR VII, from selecting your issuance workflow through to managing credential lifecycle. Start here, then follow the pages in order or jump to the topic you need.

How credential issuance works

At its core, credential issuance involves three parties:

1. Issuer: Your organization, using MATTR VII to create and sign credentials.
2. Holder: The end user who receives and stores the credential in their wallet.
3. Wallet: An application that claims, stores, and later presents the credential.

The issuance process follows the OpenID for Verifiable Credential Issuance (OID4VCI) standard. Your application creates a credential offer, the holder's wallet resolves issuer metadata, authenticates (if required), and receives a cryptographically signed credential.

The result is a credential that is:

• Tamper-evident: Any modification invalidates the signature.
• Verifiable: Any relying party can confirm authenticity against the issuer's certificate chain without contacting the issuer.
• Portable: Stored in the holder's wallet and presentable across contexts.
• Revocable: Status can be updated after issuance.

Underlying platforms

All issuance capabilities are provided through MATTR VII tenants, accessible via the MATTR Portal or API.

Explore the overview

Work through these pages to design your issuance solution from simple to more complex concepts:

1. Choose your issuance workflow: Pre-authorized Code versus Authorization Code.
2. Define your credential structure: credential configuration, data mapping, and claim data sources.
3. Deliver credential offers to holders: delivery methods and wallet targeting.
4. Optional components: authentication provider, claims source, and interaction hooks.
5. Manage issuer keys and certificates: key management options and the certificate chain of trust.
6. Manage credential lifecycle: revocation and monitoring with analytics.
7. Frequently asked questions: answers to common issuance questions.