feat: pre-flight CS-007 — Credential Presentation via the Digital Credentials API by leifj · Pull Request #246 · webuild-consortium/wp4-architecture

leifj · 2026-07-04T21:44:33Z

Pre-flight conformance specification for credential presentation using the W3C Digital Credentials API (navigator.credentials.get() with OpenID4VP).

Summary

This adds CS-007 as a pre-flight CS (per the ADR in PR #245) that defines how OpenID4VP credential presentation works when the browser's DC API serves as the invocation and transport layer.

CS-007 document (conformance-specs/cs-07-credential-presentation-dc-api.md)
- Complements CS-002 by defining DC API as the invocation/transport mechanism
- Same-device presentation via navigator.credentials.get() (§6.1)
- Cross-device presentation via CTAP2 hybrid transport (§6.2)
- Normative requirements for wallet units (WU-DC-01–06) and verifiers (VP-DC-01–07)
- Requires protocol: "openid4vp-v1-signed" for signed authorization requests with verifier X.509 authentication
- Requires response_type: dc_api.jwt for encrypted, integrity-protected responses (VP-DC-07)
- Feature detection via DigitalCredential.userAgentAllowsProtocol()
- Platform support considerations: two polyfill strategies for environments lacking DC API support
  - Browser extension polyfill (wallet-side): enables web wallets to participate via a credential provider proxy
  - Verifier-side polyfill (JS library or WASM): unified API with fallback to openid4vp:// or cross-device QR
README update: CS-007 added to the under-development table

API surface (aligned with W3C Editor's Draft, 9 July 2026)

const credential = await navigator.credentials.get({
  digital: {
    requests: [{
      protocol: "openid4vp-v1-signed",
      data: signedOpenid4vpRequest
    }]
  }
});

Dependencies

Depends on PR a pre-flight CS #245 (Pre-flight CS ADR) for the process definition

References

W3C Digital Credentials API: https://w3c-fedid.github.io/digital-credentials/
OpenID4VP over DC API: https://openid.net/specs/openid-4-verifiable-presentations-1_0-dc-api.html
DC API Ecosystem Support: https://digitalcredentials.dev/ecosystem-support
CTAP2 Hybrid Transport: https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#hybrid-transport

Pre-flight conformance specification for credential presentation using the W3C Digital Credentials API (navigator.identity.get with OpenID4VP). - Complements CS-002 by defining DC API as invocation/transport layer - Normative requirements for wallet units and verifiers - Platform support considerations: browser extension polyfill (wallet-side) and verifier-side polyfill (JS/WASM) for fallback to direct OpenID4VP - References W3C DC API, OpenID4VP, and OpenID4VP-over-DC-API specs - Updates README with CS-007 in the under-development table

Saramandus · 2026-07-06T08:56:48Z

This is in regards to #209

leifj · 2026-07-13T09:21:45Z

I updated the spec to cover CTAP+hybrid ... but this doesn't really affect the invocation or testing, its just informational.

Address review feedback: cross-device via CTAP2 hybrid transport is architecturally distinct from CS-002's QR-direct-submission flow and warrants its own section. - Add §6.2 describing cross-device flow via hybrid transport - Add WU-DC-06 and VP-DC-06 requirements (SHOULD-level) - Refine scope: clarify which cross-device pattern is out of scope - Update issuance exclusion wording (not yet mature) - Add CTAP 2.2 hybrid transport reference [7] - Update Chrome version to 141+ per ecosystem support matrix

filip-hladky · 2026-07-13T13:16:41Z

@leifj Hi Leif, I have left some comments in text since there was update to API and data in spec so we are up to date

leifj · 2026-07-13T21:10:30Z

good catch - I was looking at an older version of the spec. Will fix.

@filip-hladky

Address review comments from @filip-hladky: - navigator.identity.get() → navigator.credentials.get() (deprecated API) - providers[] → requests[] (deprecated field name) - protocol "openid4vp" → "openid4vp-v1-signed" (signed requests required for verifier authentication via X.509) - request: JSON.stringify(...) → data: <object> (data member takes object) - Add VP-DC-07: require response_type dc_api.jwt for encrypted responses - Update feature detection to DigitalCredential.userAgentAllowsProtocol() - Update W3C spec reference URL to current Editor's Draft location

leifj · 2026-07-14T10:06:55Z

Turns out my polyfill implementation at https://github.com/sirosfoundation/dc-api (@sirosfoundation/dc-api on npmjs) already used the right injection points.

georgepadayatti

Thanks for this PR. I have reviewed and suggested some changes.

@stefan-kauhaus

Per review feedback from @stefan-kauhaus: the DC API's role in issuance is lightweight (carries the credential offer, then OID4VCI takes over) but too thin for a separate CS. Include it here. Adds: - §6.3: Issuance flow via navigator.credentials.create() with openid4vci-v1 - §7.3: Issuer requirements (IS-DC-01–05) - WU-DC-07/08: Wallet issuance requirements - Updated title, scope, roles, and conformance section - Reference [8]: OID4VCI specification

endimion

really good thanks @leifj my main concern is that section 8 while useful is IMO out of scope for an interop CS...

1. Remove 'Wallet Companion' from §4 Roles table (implementation detail) 2. Fix code example: data must wrap JWT in { request: ... } object 3. Clarify §6.1.2: data.request is JWS Compact Serialization per [4] §A.3.2.1 4. Rewrite VP-DC-07: response_mode=dc_api.jwt, response_type=vp_token 5. Add VP-DC-08: expected_origins MUST be in signed DC API requests 6. Add WU-DC-09: wallet MUST validate origin against expected_origins 7. Mark §8 as informative (non-normative implementation guidance) 8. Pin [1] to dated W3C Working Draft (2026-07-15) 9. Remove dead [5] (404 URL) — DC API profile is OID4VP Appendix A [4] 10. Renumber references [5]=[ecosystem], [6]=[CTAP], [7]=[OID4VCI]

endimion · 2026-07-21T10:02:37Z

looks good from me as well! Thanks @leifj already tooke the liberty of adding support for CS07 in ITB+ https://dev-i4mlab.aegean.gr/itb/app#/admin/domains/1/specifications/2/testsuites/21/testcases/124 with an optional VP case... will add an issuance one as well

lalc · 2026-07-21T11:11:48Z

Good to merge in my mind. Great job @leifj

leifj requested review from a team, Saramandus and lalc July 4, 2026 21:44

Saramandus requested a review from stefan-kauhaus July 6, 2026 09:08

stefan-kauhaus reviewed Jul 7, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

stefan-kauhaus mentioned this pull request Jul 7, 2026

CS-007 DC API #209

Open

filip-hladky reviewed Jul 13, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

filip-hladky reviewed Jul 13, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

filip-hladky reviewed Jul 13, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md

filip-hladky reviewed Jul 13, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

peppelinux approved these changes Jul 14, 2026

View reviewed changes

georgepadayatti reviewed Jul 15, 2026

View reviewed changes

sander linked an issue Jul 15, 2026 that may be closed by this pull request

CS-007 DC API #209

Open

endimion reviewed Jul 16, 2026

View reviewed changes

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md

Comment thread conformance-specs/cs-07-credential-presentation-dc-api.md Outdated

georgepadayatti approved these changes Jul 21, 2026

View reviewed changes

lalc approved these changes Jul 21, 2026

View reviewed changes

Uh oh!

Conversation

leifj commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Contents

API surface (aligned with W3C Editor's Draft, 9 July 2026)

Dependencies

References

Uh oh!

Saramandus commented Jul 6, 2026

Uh oh!

Uh oh!

Uh oh!

leifj commented Jul 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

filip-hladky commented Jul 13, 2026

Uh oh!

leifj commented Jul 13, 2026

Uh oh!

leifj commented Jul 14, 2026

Uh oh!

georgepadayatti left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

endimion left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

endimion commented Jul 21, 2026

Uh oh!

lalc commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

leifj commented Jul 4, 2026 •

edited

Loading