OID4VCI Credential Endpoint (draft-ietf-oauth-openid4vci §8.2).
This endpoint authenticates the access token, enforces the credential
configuration entitlement carried by that token, verifies each of the
wallet's holder-key proofs against a server-issued c_nonce, and issues one
holder-bound credential per verified proof (the OID4VCI proofs batch
form). The host supplies only the credential type and claim values through
:build_credential; the library owns proof verification, holder binding,
signing, format-specific issuance, and response framing.
Summary
Functions
Issue the credential(s) requested by an authenticated wallet.
Functions
@spec create(Plug.Conn.t(), map()) :: Plug.Conn.t()
Issue the credential(s) requested by an authenticated wallet.
The action accepts either the single proof form or the batch proofs
form; each holder-key proof yields its own holder-bound credential in the
response. Every proof must verify (fresh c_nonce, correct audience, valid
signature) or the whole request fails with the same invalid_proof error,
regardless of which proof or how many failed. Credential identifiers and any
other proof or request failure are returned as the OID4VCI JSON error
envelope with status 400.