← All practicals

Run the real credential issuance protocol

Create an offer, exchange the pre-authorized code, prove your key — and watch a cnf-bound credential land in your wallet.

1. 1

   On the Verifiable Credentials lab, create an OpenID4VCI credential offer.

   A real issuer never hands a wallet the credential directly — it hands over a pre-authorized_code + PIN, each stored ONLY as a SHA-256 hash, single-use, short-lived.

2. 2

   Run the wallet: exchange the code (+ PIN) for an access token, mint a holder keypair, and build a signed proof.

   The token endpoint mints a fresh c_nonce alongside the access token; the credential endpoint will demand a proof JWT naming that EXACT nonce — a stale or foreign one is rejected outright, the core anti-replay defense.

3. 3

   Watch the credential land in your wallet and inspect its cnf claim.

   Unlike the one-click shortcut above, this credential is cryptographically bound to the specific key that proved possession — cnf: { jwk } — exactly RFC 7800's confirmation-key mechanism.