> For the complete documentation index, see [llms.txt](https://docs.inji.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inji.io/inji-wallet/inji-mobile/technical-overview/backend-services/issuer.md). # Credential Issuer ## Overview The **Issuer** is one of the backend services that Inji Wallet interacts with to obtain Verifiable Credentials (VCs). As defined by the **OpenID for Verifiable Credential Issuance (OpenID4VCI)** specification, an Issuer is responsible for issuing credentials to eligible users. Within the Inji ecosystem, **Inji Certify** acts as the Issuer. It exposes the OpenID4VCI endpoints that Inji Wallet uses to request and download issued Verifiable Credentials. User authentication is handled by a separate authorization server (eSignet) before the credential issuance process begins. Once downloaded, Inji Wallet securely stores and manages these credentials on the user's device. ## Credential Download Flow The following steps describe how Inji Wallet downloads a Verifiable Credential from an Issuer. 1. The user opens the **Add New Card** screen in Inji Wallet and selects an issuer (for example, *Republic of Veridonia National ID Department*). 2. Inji Wallet initiates the authorization flow. * The wallet redirects the user to the authorization server configured for the selected issuer (for example, **eSignet**). * The user authenticates using the configured authentication mechanism, such as a unique identifier and a One-Time Password (OTP). * Upon successful authentication, the authorization server redirects the user back to Inji Wallet with an authorization code. * Inji Wallet exchanges the authorization code for an access token. 3. Using the access token, Inji Wallet invokes the Issuer's credential endpoint exposed by **Inji Certify** to download the issued Verifiable Credential. ### Credential Endpoint The credential issuance endpoint is designed in accordance with the OpenID for Verifiable Credential Issuance (OpenID4VCI) specification. The endpoint URL is provided in the Issuer Metadata response through the `credential_endpoint` attribute. #### VC Issuance Endpoint ## VC Issuance endpoint > Once the access token is received via the token endpoint, Wallet should invoke this endpoint to get the verifiable credential. ```json {"openapi":"3.1.0","info":{"title":"e-Signet","version":"1.0"},"tags":[],"servers":[{"url":"https://esignet.collab.mosip.net/v1/esignet"}],"security":[{"Authorization-access_token":[]}],"components":{"securitySchemes":{"Authorization-access_token":{"type":"http","scheme":"bearer","description":"Access token received from /token endpoint"}},"schemas":{"CredentialProof":{"title":"CredentialProof","type":"object","description":"JSON object containing proof of possession of the key material the issued Credential shall be bound to.","properties":{"proof_type":{"enum":["jwt"],"description":"The proof object MUST contain a proof_type claim of type JSON string denoting the concrete proof type."},"jwt":{"type":"string","description":"When proof_type is jwt, a proof object MUST include a jwt claim"},"cwt":{"type":"string","description":"When proof_type is cwt, a proof object MUST include a cwt claim"}},"required":["proof_type"]},"CredentialDefinition":{"title":"CredentialDefinition","type":"object","description":"JSON object containing (and isolating) the detailed description of the credential type.\n * This object MUST be processed using full JSON-LD processing.\n * It consists of the following sub claims:\n * @context: REQUIRED. JSON array\n * types: REQUIRED. JSON array. This claim contains the type values the Wallet shall request\n * in the subsequent Credential Request.","properties":{"@context":{"type":"array","items":{"type":"string"}},"type":{"type":"array","items":{"type":"string"}},"credentialSubject":{"type":"object"}},"required":["type"]}}},"paths":{"/vci/credential":{"post":{"summary":"VC Issuance endpoint","operationId":"post-vci-credential","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"format":{"type":"string","description":"JSON string denoting the format of the issued Credential."},"credential":{"type":["object","string"],"description":"Contains issued Credential. MUST be present when acceptance_token is not returned. MAY be a JSON string or a JSON object, depending on the Credential format."}},"required":["format","credential"]}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"enum":["invalid_vc_format","invalid_proof","invalid_request","unknown_error","invalid_scope","proof_header_invalid_key","vc_issuance_failed","unsupported_credential_format","unsupported_credential_type","proof_invalid_nonce","not_implemented"]},"error_description":{"type":"string"},"c_nonce":{"type":"string","description":"This will have the value only when the error is \"proof_invalid_nonce\"."},"c_nonce_expires_in":{"type":"integer","description":"This will have the value only when the error is \"proof_invalid_nonce\"."}},"required":["error"]}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"enum":["invalid_token"]},"error_description":{"type":"string"}},"required":["error"]}}}}},"description":"Once the access token is received via the token endpoint, Wallet should invoke this endpoint to get the verifiable credential.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"format":{"description":"Format of the Credential to be issued.","enum":["ldp_vc","jwt_vc_json","jwt_vc_json-ld"]},"proof":{"$ref":"#/components/schemas/CredentialProof","description":"JSON object containing proof of possession of the key material the issued Credential shall be bound to."},"credential_definition":{"$ref":"#/components/schemas/CredentialDefinition","description":"JSON object containing (and isolating) the detailed description of the credential type.\n * This object MUST be processed using full JSON-LD processing.\n If it consists of the following sub claims:\n * @context: REQUIRED. JSON array"}},"required":["format","proof","credential_definition"]}}}},"tags":["VCI"]}}}} ``` > **For more details**: Refer to the [Inji Certify Documentation](/inji-certify/overview.md) to understand credential issuance workflows. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.inji.io/inji-wallet/inji-mobile/technical-overview/backend-services/issuer.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.