Speaking open standards: OpenID4VCI, OpenID4VP and SD-JWT credentials
A credential is worth more when any wallet built to open specifications can read it. Our August release built the groundwork for Essence to issue and verify credentials over OpenID4VCI and OpenID4VP.
A university degree, a professional registration or a proof of age is worth more when it can go into any wallet that follows the same rules, and be checked by any organisation that speaks them. A credential that only one system can read is a dead end for the person who holds it.
That is why our August release built the groundwork for Essence to speak the OpenID family of credential specifications.
Three specifications and a format
Essence already had a credential stack built on W3C standards: decentralised identifiers, verifiable credential issuance and verification with status lists, presentation exchange and DIDComm messaging. Many wallets are being built to the OpenID family, and supporting it is how Essence will issue into, receive from and verify against wallets built by others.
The work covers three specifications:
- OpenID4VCI, for issuing a credential into a wallet;
- OpenID4VP, for asking a wallet to present a credential;
- HAIP 1.0, a profile that narrows the options in both for high-assurance use.
The first credential format we are building towards is SD-JWT VC. It lets the person holding a credential reveal some of its claims and withhold the rest, so each request can be met with only the claims it needs.
What our August release built
The first part is the issuer's model:
- credential configurations, with the issuer's published metadata derived from the configurations an organisation has actually published, never from a static file;
- credential offers that use single-use codes, with a transaction code check that allows a limited number of attempts;
- issuance records that hold metadata only, never the body of the credential;
- revocation that reaches every copy of a credential at once;
- erasure that removes the link to the person while the credential's revocation status survives.
A second part, in the same release, connected the new service to the platform's entitlement checks and audit. If the platform cannot confirm that an organisation is entitled to issue, including during a sustained outage, issuance refuses cleanly instead of failing with an error. The audit events issuance produces carry no identifier for the person the credential is about.
Work has begun on the holder's side in our web and mobile apps: receiving a credential offer and answering a presentation request.
Metadata that only promises what exists
Software written to these specifications reads an issuer's published metadata and acts on it. If the metadata advertises something the service does not do, a well-behaved client will try to use it and fail.
So we treat published metadata as a promise. A presentation method is advertised only once the capability exists and its conformance tests pass. The issuer metadata follows the same rule: a credential format the platform does not issue is filtered out of it.
Choices made for the person
Some decisions are about the person whose credential it is, more than about the protocol.
Selective disclosure hides claims, but a credential's signature is the same every time it is shown, so two verifiers comparing notes could link one presentation to another. Credentials are designed to be issued in batches of single-use copies, each shown once, so that verifiers cannot make that link.
Each copy also gets its own position on a revocation list, drawn at random rather than in sequence, so neighbouring positions do not reveal which copies belong together.
Progress on the record
We keep clause-by-clause maps of the three specifications next to the code, marking each clause as covered by tests, planned or not applicable. The maps are how we track our work towards OpenID Foundation conformance.
If you issue credentials, as a university, a professional body or a public authority, the aim is that what you issue through Essence can go into any wallet built to these specifications. If you rely on credentials, it is that you can ask for exactly the claims you need. If interoperable credentials are part of your plans, we would be glad to talk.
Published 18 August 2026