cs-01: Reintroduce Pre-Authorised Code Flow (issue #213) - #265
Open
georgepadayatti wants to merge 2 commits into
Open
cs-01: Reintroduce Pre-Authorised Code Flow (issue #213)#265georgepadayatti wants to merge 2 commits into
georgepadayatti wants to merge 2 commits into
Conversation
CS-01 only permitted the Authorisation Code Flow, but several Issuer-initiated use cases depend on pre-auth. Reintroduce the OpenID4VCI Pre-Authorised Code grant, folded into the existing Credential Offer flow (6.2) rather than as a separate chapter: both grants share 6.2.1-6.2.4, diverge at the token step (6.2.5 auth code, 6.2.6 pre-auth) and converge at 6.2.7. - Issuers MAY support the pre-auth grant; WUs MUST handle it, since a WU does not control which grant an Issuer offers - tx_code REQUIRED for pre-auth offers, delivered out-of-band, as the replay mitigation named by OpenID4VCI 13.6.1 (the code has no PKCE-like session binding; see CS01_03/CS01_04) - New CS01_05: trusted-issuer check MUST and issuer-endpoint display SHOULD, per OpenID4VCI 13.6.2 tx_code phishing - Offers carry credential_configuration_ids, not scope; WU resolves scope from credential_configurations_supported - authorization_server added to both grant objects - WIA client authentication REQUIRED at Token Endpoint (OPTIONAL in OpenID4VCI for this grant); anonymous access prohibited - README: CS-001 to v1.1 Closes webuild-consortium#213 Supersedes webuild-consortium#258 Co-authored-by: Tomasz Błachowicz <147986+tblachowicz@users.noreply.github.com>
georgepadayatti
requested review from
endimion,
lalc,
stefan-kauhaus and
tblachowicz
July 21, 2026 11:21
lalc
approved these changes
Jul 21, 2026
lalc
left a comment
lalc
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me @tblachowicz @georgepadayatti
tblachowicz
approved these changes
Jul 21, 2026
Collaborator
There was a problem hiding this comment.
All good. No further comments. Thanks @georgepadayatti for making the changes.
endimion
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #213. Builds on #258 by @tblachowicz. All of that PR's content is included here, restructured per the review feedback on it. Supersedes #258.