Version 1.0.0-alpha.1

Release Version: v1.0.0-alpha.1

Release Type: Developer Release

Release Date: 31st July, 2026

Note

Inji Certify v1.0.0-alpha.1 marks our formal adoption of the OpenID4VCI 1.0 specification. This is an important milestone, and we want to provide clear guidance for all community members.

Upgrading is optional but recommended for spec compliance. This release is intended for teams ready to align with the finalized OpenID4VCI 1.0 standard. Teams running earlier Certify release versions built on draft specifications of OpenID4VCI are not mandatory to upgrade — the earlier releases can be continued without any disruption, with the option to upgrade at a time that suits your roadmap.
For those upgrading to v1.0.0-alpha.1, This release does not maintain backward compatibility with earlier draft specifications of OpenID4VCI. APIs, credential formats that have been updated or replaced are listed below wherever required. Reviewing that section before upgrading is strongly recommended.

Overview

Inji Certify v1.0.0-alpha.1 delivers comprehensive alignment with the OpenID4VCI 1.0 specification and introduces critical enhancements to credential issuance workflows, interoperability, and system stability. This release focuses on modernizing the credential issuance architecture, removing draft implementations, and providing enhanced support for emerging credential formats.

Key Changes:

OpenID4VCI 1.0 specification alignment (credential endpoint, well-known metadata, authorization flows)
Credential format transitions (vc+sd-jwt to dc+sd-jwt)
Addition of Nonce endpoint

Major Features & Enhancements

Credential Issuance Endpoint Enhancement The credential issuance endpoint has been upgraded to full OpenID4VCI 1.0 compliance. Requests now require a mandatory credential_configuration_id field, and the format field is rejected in requests as per the specification. Array-based proof JWT validation is supported, and request/response structures have been updated accordingly. Validation mechanisms have been enhanced and error handling improved throughout the issuance flow.
Issuer Well-Known Metadata Update The /.well-known/openid-credential-issuer endpoint response has been updated to reflect OpenID4VCI 1.0 adoption. The metadata now exposes the new nonce_endpoint, includes updated claim display properties per the 1.0 schema, and externalizes metadata configuration for greater flexibility. The full response has been validated against the OpenID4VCI 1.0 specification.
Nonce Endpoint Implementation A dedicated /nonce endpoint has been introduced for c_nonce generation and replay attack prevention. Nonces are cryptographically generated with a configurable TTL-based expiration and stored in Redis with automatic expiry. During credential issuance, the nonce is validated and marked as used. As a result, c_nonce has been removed from the access token response in line with the updated specification. Breaking Change: Clients must now call the /nonce endpoint separately, as c_nonce is no longer included in the token response.
Replace Credential Format: vc+sd-jwt → dc+sd-jwt The vc+sd-jwt credential format has been replaced with the standardized dc+sd-jwt format as mandated by OpenID4VCI 1.0 . Breaking Change: The vc+sd-jwt format is no longer supported and all configurations must be updated.
Pre-Authorized Credential Offer API Enhancement The /pre-authorized-data API has been upgraded to comply with the OpenID4VCI 1.0 specification. The credential_configuration_id is now validated against issuer metadata via /.well-known/openid-credential-issuer, and claims are validated against the structures defined in the credential configuration. Unknown or unsupported claims are rejected, while existing API logic outside the claims validation scope remains unchanged.
Configurable JSON-LD Context Loader with Caching A Spring-managed JSON-LD DocumentLoader has been introduced to resolve JSON-LD @context IRIs during Verifiable Credential processing. It provides a configurable context registry (mapping context IRIs to classpath, file, or HTTP resources), an in-memory cache with TTL and a maximum-entry limit, startup preload of configured contexts, and controlled remote resolution guarded by a host allowlist and an opt-in toggle for unknown contexts. The W3C Credentials v1/v2 and Ed25519 Security Suite v1 contexts are bundled locally by default. This removes the runtime dependency on external context hosts, improving latency, reliability, and security (mitigating SSRF-style risks) during proof generation. Configuration lives under the new mosip.certify.jsonld.* namespace. See JSON-LD Context Loader documentation for details.

User Stories Released

Feature

Description

Git Id

Credential Issuance endpoint Enhancement

Enhancement of Credential Issuance Endpoint to Support OpenID4VCI 1.0 Features

#678

Enhance pre-authorized credential offer API , claims validation

Enhance pre-authorized credential offer API , claims validation as per OpenID4VCI 1.0 issuer metadata response

#845

Issuer Well-known metadata to adopt 1.0 OpenID4VCI changes

Update Credential Issuer Well-Known Metadata for OpenID4VCI 1.0 Adoption

#676

Replace format vc+sd_jwt to dc_sd_jwt

Replace Credential Format from vc+sd-jwt to dc+sd-jwt for OpenID4VCI 1.0 Compliance

#677

Nonce endpoint implementation

Implementation of nonce_endpoint for c_nonce generation and replay attack prevention

#675

Bug Fixes

The following bugs have been addressed in this release.

Bug ID

Description

#690

Error message mismatch in mock -mdl use case

#686

Error messages mismatch in mdoc-mdl use case(PDI)

#681

Getting Canonicalization error when try to get VC intermittently

#715

"uri" field is mandatory if logo is present in issuer metadata

#716

nonce Should Be Optional in Verifiable Credential Issuance

#863

Not able to configure Vc issuance plugin for Mosipid use cases in release-0.14.x

Known Issues

Below is the list of known issues related to the release v1.0.0-alpha.1. To access all open issues related to Inji Certify please click here

Issue ID

Description

#842

Validations to add "qrSignatureAlgo" in credential config API

#679

Validations issues for qrsettings block in Credential config API

#878

unknown_error returned for negative scenarios

#967

Credential Issuer Metadata not served at spec-mandated well-known path for issuer identifiers with a path component

#966

Facing issue at automating the mdocVP test cases. Getting "VP cryptographic verification failed

Breaking Changes

Replaced APIs & Formats

vc+sd-jwt format - replaced by dc+sd-jwt
- Required Action: Update credential configurations to use dc+sd-jwt format
- Impact: Clients must upgrade configuration or credential issuance will fail
c_nonce in access token response - Removed
- Required Action: Clients must now call /nonce endpoint to retrieve c_nonce
- Impact: Access token responses no longer include c_nonce; separate endpoint call required