Frequently asked questions

Answers to common questions about credential issuance with MATTR VII. For the concepts behind these answers, see the issuance overview.

Frequently asked questions

What credential formats does MATTR VII support for issuance?

MATTR VII supports mDocs (aligned with ISO/IEC 18013-5) and CWT/Semantic CWT credential formats through OID4VCI. Direct issuance (API-based, no wallet interaction) is available for CWT credentials.

Which wallets can receive credentials issued by MATTR VII?

Any wallet that implements the OID4VCI specification can receive credentials. You can target specific wallets using custom URI schemes or claimed HTTPS links, or allow any compatible wallet using the standard scheme.

MATTR also provides its own holding solutions that are fully compatible with MATTR VII issuance:

• MATTR Holder SDKs: embed credential holding capabilities directly into your own mobile application (iOS, Android, React Native).
• MATTR GO: a ready-to-use wallet application for end users.

Do I need my own identity provider?

For the Authorization Code flow, yes, you need an OIDC-compliant identity provider. For the Pre-authorized Code flow, no. You authenticate users through your own means before creating the credential offer.

Can I issue credentials without user interaction?

Yes. The Pre-authorized Code flow supports silent issuance within existing app sessions. Your application creates the credential offer programmatically and the wallet claims it without requiring the user to authenticate again.

How do I populate credential data from my existing systems?

Use a claims source, an HTTPS endpoint that MATTR VII calls to fetch data from your backend systems. Claims are mapped into the credential via your credential configuration's claim mappings.

What happens if my claims source is unavailable?

If the claims source times out (>3 seconds) or returns a non-2xx response, issuance fails. Design your claims source for high availability and consider which claims are marked as required vs optional with defaultValue fallbacks.

Can I add custom verification steps before issuing?

Yes. Use an interaction hook in the Authorization Code flow to add biometric checks, consent flows, or other custom logic between authentication and issuance.

How do I revoke a credential after issuance?

Use the MATTR VII revocation API to update the credential's status. The updated status is reflected in the published status list that verifiers check. See credential revocation for details.

Can I issue multiple credentials in one flow?

Yes. A credential offer can reference multiple credential configurations, allowing the holder to claim several credentials in a single interaction.

What is the maximum validity period for an mDL?

mDL credentials have a maximum validity constraint of 427 days, enforced by the credential configuration. Plan your refresh or re-issuance strategy accordingly.

What is OID4VCI?

OID4VCI (OpenID for Verifiable Credential Issuance) is an open standard from the OpenID Foundation that defines how a digital credential issuer can deliver verifiable credentials to a digital wallet in a secure and interoperable way. It builds on OAuth 2.0, a protocol widely used for authentication and authorization on the web.

Why does OID4VCI matter for credential issuance?

OID4VCI gives issuers a standards-based, interoperable way to deliver verifiable credentials to any compliant wallet, instead of building a bespoke integration per wallet. That means issuers can reach a broader holder base, wallets can support credentials from many issuers, and ecosystems can grow without each participant having to coordinate one-to-one.

What are the two OID4VCI flows?

OID4VCI defines two flows:

• Authorization Code flow: The holder is redirected to the issuer to authenticate and consent. The wallet then exchanges an authorization code for an access token and retrieves the credential.
• Pre-authorized Code flow: The issuer prepares the credential in advance and hands the wallet a pre-authorized code (often via a QR code or link), so the holder does not need to authenticate again at issuance time. A transaction code can be added for additional security.

How do MATTR VII and the MATTR Portal support OID4VCI?

MATTR VII supports both OID4VCI flows (Authorization Code and Pre-authorized Code) and multiple credential formats. You can configure issuance through the MATTR VII Platform API, or through the MATTR Portal, which provides a user interface for managing tenants, credential configurations, claims sources, and issuance flows without writing code.

Is OID4VCI the same as OpenID Connect?

No. OpenID Connect is a protocol for identity authentication, typically used to sign a user into an application. OID4VCI builds on the same underlying OAuth 2.0 foundations as OpenID Connect, but it is purpose-built for issuing verifiable credentials, not for authenticating sessions. The two are complementary and often used together (for example, OpenID Connect can authenticate the holder during the Authorization Code flow).