OpenID4VCI Deep Dive: 1.0 Final, the Errata, Interactive Authorization in 1.1, and Server-to-Server
In OpenID4VCI 1.0 Final, a Wallet that sends the wrong PIN gets invalid_grant . A Wallet whose Pre-Authorized Code has expired also gets invalid_grant . The Wallet can't tell "ask the user to type it again" from "this offer is dead", and the Final text puts no limit on how many PINs an attacker may try against one code. Both have been addressed since, in two different documents with two different…
OpenID4VCI, version 1.0, reached final status on September 16, 2025, with 102 approvals, one object, and 12 abstentions. The errata set 1, numbered 1.0/, has revision -19. An editor's draft for version 1.1, also labeled 1.1/, revision -01, was created from the same text as the final version and subsequently extended. Additionally, an editor's draft for the server-to-server aspect, labeled s2s/, revision -01, was merged on August 4, 2026 (PR #753).
A Wallet that provides an incorrect PIN receives an "invalid_grant" error, as does a Wallet whose Pre-Authorized Code has expired. The Wallet cannot differentiate between these scenarios. The text clarifies that no limit is set on the number of PIN attempts an attacker can make against a single code. Both issues were addressed in subsequent documents, but these documents are distinct from the approved final text.
OpenID4VCI operates on top of OAuth and introduces several new elements. The Credential Issuer functions as an OAuth Resource Server with the mandatory Credential Endpoint. Optional endpoints include Nonce, Deferred Credential, Notification, and Credential Offers. The Wallet, acting as an OAuth client, discovers the Authorization Server through the issuer's metadata, obtains an access token, and subsequently calls POST /credential.
Four main additions were made in version 1.0: the grant type "urn:ietf:params:oauth:grant-type:pre-authorized_code," RAR type "openid_credential," the "issuer_state" authorization request parameter, and a credential_offer_endpoint in the Wallet client metadata. The actual flow remains consistent across all these elements. Pre-Authorized Code Flow involves the issuer identifying the user through its own process (e.g., a bank login), the Wallet receiving a QR code with a code, trading this code for a token, and utilizing a transaction code (tx_code) sent to the user via a second channel.
Token Request is POST /token with no client_id and optional client authentication, depending on the authorization server's settings.
Server-to-Server (s2s) draft introduced in August 2026 addressed limitations in the initial spec, particularly concerning rate limiting for Pre-Authorized Code flows and the authentication requirements surrounding the tx_code.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
