Issuer
Issues and signs credentials, publishes revocation status. Supports both OID4VCI 1.0 FINAL flows and enforces FAPI 2.0: PAR, PKCE (S256 only) and DPoP sender-constrained tokens.
- OID4VCI 1.0 FINAL
- SD-JWT VC · mdoc
- FAPI 2.0
Trust, Verified.
A complete, standards-tested stack for issuing and verifying credentials.
Building a credential-based identity system takes an issuer, a verifier, an operator console and a wallet. Miss one and the flow breaks. Veritra ships all four, and tests all four together.
Tested, not claimed.
OpenID Foundation conformance suite 5.1.44, run against all three roles. Each tile is one test module.
OIDF conformance suite 5.1.44 · executed 2026-09-03
OID4VCI 1.0 FINAL + HAIP 1.0 FINAL
OID4VP 1.0 FINAL + HAIP 1.0 FINAL
OID4VP 1.0 FINAL + HAIP 1.0 FINAL
Each tile is one test module. Point at one to see which.
Skipped modules test optional features the implementation does not advertise. Review modules are cases where the implementation correctly rejected the request and the process requires a screenshot of that rejection — all were submitted. These results were produced by running the suite ourselves; they are not an OpenID Foundation certification.
Four components, one stack.
Verifier
Verifies presentations through a nine-step pipeline and records a verification receipt. Identifies itself by certificate thumbprint, so relying-party trust needs no separate registration step.
- OID4VP 1.0 FINAL
- DCQL
- direct_post.jwt
Admin consoles
Deployed separately for issuer and verifier. Issuer and verifier are distinct legal entities in the trust triangle; a session token for one must never work on the other.
- Issuance · status · trust list
- Audit chain verification
- On-chain role inventory
Wallet reference app
Holds credentials on the user's device and discloses only the claims requested. Keys stay in the device secure storage.
- iOS · Android
- Selective disclosure
- 6 languages
Standards coverage
| Layer | Standard | Scope |
|---|---|---|
| Identifier | W3C DID Core 1.0 | did:ethr:besu, did:key (P-256) |
| Credential format | IETF SD-JWT VC | Selective disclosure, key binding |
| Credential format | ISO/IEC 18013-5 mdoc | MSO, COSE_Sign1 |
| Issuance | OID4VCI 1.0 FINAL | PAR, DPoP, client attestation |
| Presentation | OID4VP 1.0 FINAL | direct_post.jwt, signed request URI |
| Query | DCQL | Claim-level queries |
| Profile | HAIP 1.0 FINAL | Issuer, verifier and wallet |
| Trust framework | OpenID Federation 1.0 | Entity configuration, subordinates |
| Security profile | FAPI 2.0 Security Profile FINAL | Implemented and tested |
| Status | IETF Token Status List | Revocation and suspension |
We also list what we do not implement: credential response encryption (JWE), key attestation, request_uri_method=post, refresh tokens and W3C VC Data Model 2.0 are not advertised by the current build.
Conformance plans
| Plan | Variant | Modules | Result |
|---|---|---|---|
| oid4vci-1_0-issuer-haip-test-plan | sd_jwt_vc · wallet_initiated | 62 | passed 54 review 3 skipped 5 |
| oid4vp-1final-verifier-haip-test-plan | x509_hash · request_uri_signed | 10 | passed 9 skipped 1 |
| oid4vp-1final-wallet-haip-test-plan | sd_jwt_vc · direct_post.jwt | 12 | passed 6 review 6 |
Deployment: on-premises or private cloud, every component as an OCI container, minimum 4 vCPU / 8 GB RAM each. Key material in AWS KMS, HashiCorp Vault, Azure Key Vault or PEM. Full Korean detail on the Korean product page.
Run one credential end-to-end first.
The PoC is a four-to-six week evaluation: one issuance and one verification in your own environment.