OPENID4VP 1.0 DEMO
NOT A PRODUCTION SERVICE

A demonstration environment built to show how OpenID4VP 1.0 can be integrated into a platform for user authentication and claim validation. Do not use it to sign in to anything you care about.

Digital Credentials API · Verifiable presentations

OPENID4VP 1.0

Test an end-to-end OpenID for Verifiable Presentations (OpenID4VP) sign-in and claim-verification flow, including the relying-party user experience. This is the first release of the demo and currently supports one presentation scenario: a Google-verified email credential.

Test tooling

Request configuration

UNSIGNED PROFILE
Verifier request type openid4vp-v1-unsigned
Claims included in the DCQL query
2 of 7 selected
Backend-generated request payload

Read-only preview of the exact request returned by the backend.

Choose the requested claims, then start sign-in.
Demonstration context Understand the test scenario The Google verified-email flow, and what your device needs
The demonstrated use case

Google verified email, presented over OpenID4VP

DC+SD-JWT · USERINFOCREDENTIAL

This release exercises one scenario end to end: a Google-verified email credential, held in Android Credential Manager, presented to a relying party and cryptographically verified before any account is touched. No password exists anywhere in the flow.

01 · BackendMints a nonce and builds the DCQL request.
02 · ChromeHands the request to the W3C Digital Credentials API.
03 · AndroidCredential Manager offers an eligible credential; the holder consents.
04 · BackendVerifies the SD-JWT presentation, then signs the holder in.

An unrecognized email lands on a prefilled account-creation form. A known one gets a welcome-back view with its previous sign-in time and an activity report. The same verified claim drives both paths.

Before you test

Device and software requirements

Android
9 / API 28 or newer
Play services
25.49.x or newer
Browser
Current stable Chrome on Android
Google account
A consumer account. Workspace and supervised accounts cannot present this credential.
Transport
An HTTPS secure context. A LAN http://192.168… origin will not work.
Network
Connectivity is required for the duration of the presentation.

A non-Gmail address was verified when the Google Account was created, but Google gives no long-term freshness guarantee. A production system should add its own OTP challenge.

Specification and source Know the building blocks The spec, the working repository, and every backend endpoint
Specification OpenID for Verifiable Presentations 1.0 The normative document this demo implements: DCQL queries, the dc_api response mode, and the unsigned request profile used here. openid.net/specs/openid-4-verifiable-presentations-1_0.html Working repository openid/OpenID4VP Where the OpenID Foundation drafts the specification and tracks issues against it. The place to read what is changing next. github.com/openid/OpenID4VP
This demo TheCarvas/openid4vp-interactive-demo github.com/TheCarvas/openid4vp-interactive-demo A Vite front end over an Express backend. The backend is the verifier: it owns the nonce, builds the request, checks the presentation, and keeps the account and trace records. Every endpoint it exposes: POST /api/auth/email/requestMints a nonce, builds the nonce-bound DCQL request for the selected claims, and opens a flow record. POST /api/auth/email/verifyVerifies the returned SD-JWT presentation: issuer signature, key binding JWT, nonce match, audience and origin, disclosure digests. POST /api/auth/email/verify-sampleRuns the same verification against an operator-uploaded capture, for the demo fallback path. POST /api/auth/email/signupCreates or links the account against the verified email and records the sign-in activity entry. GET /api/diagnostics/configReports which diagnostic levels the backend allows and whether artifact capture is enabled. GET /api/diagnostics/traces/:idReturns the persistent trace: envelope, ordered events, and captured credential artifacts. POST /api/diagnostics/traces/:id/eventsAccepts frontend-tier events so both sides of the flow land in one ordered trace. POST /api/diagnostics/traces/:id/artifactsStores credential material captured at debug level for later inspection.