Presenting credentials
How a credential is verified when a holder authenticates using FortifiedID EID.
When a holder authenticates somewhere with their credential, the mobile wallet signs and delivers an SD-JWT VC presentation to the verifier. EID Server participates by issuing the verifier authorization that allows a configured verifier to request presentations from credentials it has issued.
Credential presentation follows the OIDC4VP protocol:
- The verifier creates a pending session and issues a signed proof request specifying the accepted issuer, required credential type, required claims, nonce, and audience. It fetches a verifier authorization JWT from EID Server as part of this step.
- The holder opens the eID app via QR code on desktop or deep link on mobile. The app fetches the signed proof request from the verifier.
- The app filters the holder's stored credentials to those that match the issuer, credential type, and required claims. If more than one credential qualifies, the user selects which to use.
- The user authorizes the presentation with their PIN — or YubiKey and PIV PIN for LoA4 credentials. The app assembles the SD-JWT presentation, including only the claimed values the verifier requested, and signs a key-binding JWT.
- The app posts the presentation to the verifier. The verifier validates the issuer signature, credential type, disclosed claims, nonce, audience, key binding, expiry, and revocation status.
Disclosed claims
Section titled “Disclosed claims”The presentation contains only the claims the verifier explicitly listed in required_claims. Two claims are added to every issued credential automatically and can be disclosed:
| Claim | Value |
|---|---|
assuranceLevel |
loa3 or loa4 |
organizationID |
The organization's external identifier |
All other available claims are defined by the organization's VC profile. See Credential content for the full list.
Level of assurance
Section titled “Level of assurance”The assuranceLevel claim records whether the credential was issued at LoA3 or LoA4. Because it is selectively disclosable, it is only included in a presentation when the verifier lists it in required_claims. Verifiers that need to enforce a minimum assurance level should always request this claim and validate its value after a successful authentication.
Verifier setup
Section titled “Verifier setup”The verifier is configured in Access, not in EID Server. The Access documentation covers the full configuration reference, mobile endpoint descriptions, event logging, and required_claims usage:
FortifiedID eID authenticator — Access documentation