Choose an issuance flow

MATTR VII supports the two OID4VCI flows. Your choice depends on how much control you need over user authentication during claiming, and on the credential type you chose in step 1.

The quickest way to decide is to ask when the user is authenticated:

• Choose the Pre-authorized Code flow when the user is already authenticated before issuance, for example a known user you have verified out of band.
• Choose the Authorization Code flow when you need to authenticate the user during the issuance flow, for example a public offer or a self-service portal.

Pre-authorized Code flow

Choose this flow for issuing to known users, silent issuance within an existing app session, or high-assurance credentials where identity has already been verified out of band.

The issuer authenticates the user externally, prepares the credential data, and creates a single-use offer. The wallet claims the credential without an additional authentication step.

• Offers are single-use, consumed after a successful claim.
• Supports mDocs.
• An optional transaction code adds two-factor security.

Ready to build it? See the Pre-authorized Code flow guide.

Authorization Code flow

Choose this flow for public-facing credential offers, self-service portals, or scenarios needing real-time identity verification.

The holder scans a QR code or clicks a link, authenticates through your identity provider, and the credential is issued on successful authentication.

• Offers are reusable, so multiple users can claim from the same offer.
• Supports mDocs and CWT.
• Integrates with your existing OIDC identity provider.
• Supports optional interaction hooks for additional verification steps.

Ready to build it? See the Authorization Code flow guide.

Format and flow support

If you chose CWT in step 1, use the Authorization Code flow.

Next

Once you have chosen a flow, set up your signing certificates.