add `redirect_uri` to Credential Offer by paulbastian · Pull Request #759 · openid/OpenID4VCI

paulbastian · 2026-06-18T18:42:19Z

Replaces #723

discuss whether to use SHOULD or MAY to open redirect_uri
make editorial changes to fix grants text in Credential Offer Parameters in 1.0?
discuss whether expected_redirect_origins should be origins or paths

paulbastian · 2026-06-22T08:39:26Z

+  * `authorization_code`: OPTIONAL. Object for the Authorization Code Grant type.
+    * `issuer_state`: OPTIONAL. String value created by the Credential Issuer and opaque to the Wallet that is used to bind the subsequent Authorization Request with a context set up during previous process steps. If the Wallet decides to use the Authorization Code Flow and received a value for this parameter, it MUST include it in the subsequent Authorization Request to the Authorization Server as the `issuer_state` parameter value.
+    * `authorization_server`: OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when `authorization_servers` parameter in the Credential Issuer metadata has multiple entries. It MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the `authorization_servers` array obtained from the Credential Issuer metadata.
+  * `urn:ietf:params:oauth:grant-type:pre-authorized_code`: OPTIONAL. Object for the Pre-authorized Code Grant type.
+    * `pre-authorized_code`: REQUIRED. The code representing the Credential Issuer's authorization for the Wallet to obtain Credentials of a certain type. This code MUST be short lived and single use. If the Wallet decides to use the Pre-Authorized Code Flow, this parameter value MUST be included in the subsequent Token Request with the Pre-Authorized Code Flow.
+    * `tx_code`: OPTIONAL. Object indicating that a Transaction Code is required if present, even if empty. It describes the requirements for a Transaction Code, which the Authorization Server expects the End-User to present along with the Token Request in a Pre-Authorized Code Flow. If the Authorization Server does not expect a Transaction Code, this object is absent; this is the default. The Transaction Code is intended to bind the Pre-Authorized Code to a certain transaction to prevent replay of this code by an attacker that, for example, scanned the QR code while standing behind the legitimate End-User. It is RECOMMENDED to send the Transaction Code via a separate channel. If the Wallet decides to use the Pre-Authorized Code Flow, the Transaction Code value MUST be sent in the `tx_code` parameter with the respective Token Request as defined in (#token-request). If no `length`, `description`, or `input_mode` is given, this object MAY be empty.
+      * `input_mode` : OPTIONAL. String specifying the input character set. Possible values are `numeric` (only digits) and `text` (any characters). The default is `numeric`.
+      * `length`: OPTIONAL. Integer specifying the length of the Transaction Code. This helps the Wallet to render the input screen and improve the user experience.
+      * `description`: OPTIONAL. String containing guidance for the Holder of the Wallet on how to obtain the Transaction Code, e.g., describing over which communication channel it is delivered. The Wallet is RECOMMENDED to display this description next to the Transaction Code input screen to improve the user experience. The length of the string MUST NOT exceed 300 characters. The `description` does not support internationalization, however the Issuer MAY detect the Holder's language by previous communication or an HTTP Accept-Language header within an HTTP GET request for a Credential Offer URI.
+    * `authorization_server`: OPTIONAL string that the Wallet can use to identify the Authorization Server to use with this grant type when `authorization_servers` parameter in the Credential Issuer metadata has multiple entries. It MUST NOT be used otherwise. The value of this parameter MUST match with one of the values in the `authorization_servers` array obtained from the Credential Issuer metadata.


for reviews: this part is only moved upwards

Co-authored-by: Gareth Oliver <gco@google.com>

paulbastian · 2026-07-02T15:44:33Z


 Additional Credential Offer parameters MAY be defined and used.
 The Wallet MUST ignore any unrecognized parameters.



these editorial changes move these two lines further down, which currently split the grants parameter from the grants values

jogu · 2026-07-15T22:10:26Z

    }
-  }
+  },
+  "redirect_uri": "https://credential-issuer.example.com/return?issuer_state=eyJhbGciOiJSU0Et...FYUaBy"


This makes me feel uneasy. If issuer_state is likely to be something important here, it feels like we should guarantee that the issuer_state passed to the redirect_uri is the one that was used in this session? (i.e. that it hasn't been switched out by an attacker.)

Does it help to remove the issuer_state query parameter?

I remove the query parameter

Co-authored-by: Paul Bastian <paul.bastian@posteo.de>

Co-authored-by: Joseph Heenan <joseph@authlete.com>

paulbastian · 2026-07-30T14:28:43Z

@jogu could you review again please?
@fkj @c2bo can you review?

dpostnikov · 2026-08-05T08:40:54Z

DCP WG call today: Awaiting @jogu and @c2bo review

add redirect_uri to Credential Offer

9677a51

dpostnikov requested review from GarethCOliver and fkj June 22, 2026 08:06

paulbastian commented Jun 22, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

Apply suggestion from wg discussion

e127cca

paulbastian commented Jun 22, 2026

View reviewed changes

GarethCOliver reviewed Jun 22, 2026

View reviewed changes

brentzundel mentioned this pull request Jun 25, 2026

Add redirect_uri to (Deferred) Credential (Error) Response to continue interaction with end user #723

Closed

fkj reviewed Jun 29, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

paulbastian and others added 4 commits July 1, 2026 10:05

Apply suggestions from code review

293a9a6

Co-authored-by: Gareth Oliver <gco@google.com>

Apply suggestion from @paulbastian

756809a

Merge branch 'main' into pb/redirect

636ee78

Fix Credential Offer parameter description

92842de

paulbastian mentioned this pull request Jul 1, 2026

Warm welcome URL et al #773

Open

paulbastian commented Jul 2, 2026

View reviewed changes

GarethCOliver approved these changes Jul 9, 2026

View reviewed changes

mickrau approved these changes Jul 9, 2026

View reviewed changes

jogu requested changes Jul 15, 2026

View reviewed changes

c2bo reviewed Jul 16, 2026

View reviewed changes

Comment thread 1.0/openid-4-verifiable-credential-issuance-1_0.md

paulbastian commented Jul 16, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

paulbastian and others added 2 commits July 16, 2026 17:13

Apply suggestions from code review

86ecefe

Co-authored-by: Paul Bastian <paul.bastian@posteo.de>

Apply suggestion from @jogu

d5875ce

Co-authored-by: Joseph Heenan <joseph@authlete.com>

paulbastian commented Jul 16, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

Apply suggestion from @paulbastian

9cc226e

paulbastian commented Jul 21, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

paulbastian added 2 commits July 21, 2026 14:58

Apply suggestion from @paulbastian

1cd33ec

rename expected_redirect_origin to expected_redirect_origins

9bf2345

paulbastian commented Jul 21, 2026

View reviewed changes

Comment thread 1.1/openid-4-verifiable-credential-issuance-1_1.md Outdated

paulbastian added 2 commits July 21, 2026 19:09

Apply suggestion from @paulbastian

b1fee80

remove issuer_state parameter from redirect_uri

415c797

paulbastian added 3 commits July 30, 2026 16:24

minor fixes

d14ad13

add security consideration for redirect_uri

765bf58

clarification on which user agent is used on redirect_uri

cee9e79

Sakurann requested review from c2bo, fkj and jogu July 30, 2026 15:49

fkj approved these changes Jul 30, 2026

View reviewed changes


		Additional Credential Offer parameters MAY be defined and used.
		The Wallet MUST ignore any unrecognized parameters.

Uh oh!

Conversation

paulbastian commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

paulbastian Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulbastian Jul 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jogu Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

paulbastian Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

paulbastian Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paulbastian commented Jul 30, 2026

Uh oh!

dpostnikov commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

paulbastian commented Jun 18, 2026 •

edited

Loading