---
title: "Credential endpoint (holder proof-of-possession → SD-JWT VC)"
method: POST
path: "/v1/credential"
tags: ["OpenID4VCI Protocol"]
---

# Credential endpoint (holder proof-of-possession → SD-JWT VC)

`POST /v1/credential`

Redeem an issuance access token and holder proof for an SD-JWT VC (Selective-Disclosure JWT Verifiable Credential). Send the proof generated by the holder wallet after you mint a nonce. Didit returns the issued credential and its VCT (Verifiable Credential Type).

## Request body

- object
  - `proof` object, required — Send the holder proof object that binds issuance to the holder key.
    - `jwt` string, required — Send the holder proof JWT (JSON Web Token). The captured value is redacted.
    - `proof_type` string, required — Send the proof type advertised by the issuer metadata.

## Response `200`

Didit issued the credential.

- object
  - `credential` string — Store this issued SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) string in the holder wallet.
  - `credentials` object[] — You receive the issued credentials array for wallet-compatible clients.
    - `credential` string — Store this issued credential string in the holder wallet.
  - `vct` string — You receive the VCT (Verifiable Credential Type) of the issued credential.

## Other responses

- `400` — Missing or invalid proof (no `proof.jwt`, expired/invalid access token, expired/consumed c_nonce, malformed proof payload, bad key binding, or wrong audience).
- `401` — Unauthorized — a valid tenant API key (Bearer) was not supplied. (Example: invalid issuance access token.)

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/e4eddba66557/schema)