Attesto.CredentialIssuerMetadata (Attesto v1.8.0)

Copy Markdown View Source

OID4VCI Credential Issuer Metadata (draft-ietf-oauth-openid4vci §11.2).

Build the JSON document a wallet fetches from /.well-known/openid-credential-issuer to discover the Credential Issuer's credential endpoint, supported credential configurations, and optional issuance capabilities.

This module is the pure, conn-free, HTTP-free half of that endpoint. It returns a string-keyed map ready to serialise as JSON; serving the document is the host's concern. Nil values are omitted so the document advertises only capabilities the host provides. Unknown options and unknown fields in credential configurations are ignored.

signed/2 produces the optional signed JWT representation of the document (OID4VCI §11.2.2), served when a wallet requests Accept: application/jwt.

Summary

Functions

build(opts)

Build the OID4VCI Credential Issuer Metadata document.

signed(metadata, opts)

Represent a metadata document as a signed JWT (OID4VCI §11.2.2).

Functions

build(opts)

@spec build(keyword()) :: %{required(String.t()) => term()}

Build the OID4VCI Credential Issuer Metadata document.

Required options:

  • :credential_issuer - the Credential Issuer Identifier URL.
  • :credential_endpoint - the URL of the credential endpoint.
  • :credential_configurations_supported - a non-empty map from credential-configuration IDs to configuration maps.

Optional options are :authorization_servers, :nonce_endpoint, :deferred_credential_endpoint, :notification_endpoint, :credential_response_encryption, :batch_credential_issuance, and :display. Each is included only when supplied with a non-nil value.

Configuration maps are normalized to the supported OID4VCI members and their nil values are omitted. A format is required for every configuration. vct is additionally required for vc+sd-jwt and dc+sd-jwt configurations.

signed(metadata, opts)

@spec signed(
  %{required(String.t()) => term()},
  keyword()
) :: String.t()

Represent a metadata document as a signed JWT (OID4VCI §11.2.2).

Served when a wallet requests signed metadata with Accept: application/jwt. The header carries typ: openidvci-issuer-metadata+jwt and the issuer's public signing key as jwk, so the wallet verifies the signature without a separate key lookup. The claims are the document's members plus iss/sub (the Credential Issuer Identifier) and iat.

metadata is a document from build/1. Required option :pem is the issuer signing key; optional :now overrides the iat clock (unix seconds).