---
title: "OpenID4VCI issuer metadata"
method: GET
path: "/v1/issuers/{slug}/.well-known/openid-credential-issuer"
tags: ["OpenID4VCI Protocol"]
---

# OpenID4VCI issuer metadata

`GET /v1/issuers/{slug}/.well-known/openid-credential-issuer`

Fetch the OpenID4VCI (OpenID for Verifiable Credential Issuance) issuer metadata for a tenant. Wallets use this document to discover the credential, nonce, token, and SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuer endpoints. The metadata also lists credential configurations keyed by VCT (Verifiable Credential Type).

## Path parameters

- `slug` string, required

## Response `200`

Didit returned the OpenID4VCI issuer metadata.

- object
  - `credential_configurations_supported` object — You receive supported credential configurations keyed by VCT (Verifiable Credential Type). This captured issuer exposes five configurations.
    - `AgeOver18` object — Use this captured configuration to request an AgeOver18 credential.
      - `credential_signing_alg_values_supported` string[] — You receive the credential signing algorithms this issuer supports.
      - `cryptographic_binding_methods_supported` string[] — You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.
      - `format` string — Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.
      - `proof_types_supported` object — You receive proof types the credential endpoint accepts.
        - `jwt` object — Use this JWT (JSON Web Token) proof type for holder proof-of-possession.
          - `proof_signing_alg_values_supported` string[] — You receive the proof signing algorithms this issuer accepts.
      - `vct` string — You receive the VCT (Verifiable Credential Type) for this configuration.
    - `AirlineLoyalty` object — Use this captured configuration to request an AirlineLoyalty credential.
      - `credential_signing_alg_values_supported` string[] — You receive the credential signing algorithms this issuer supports.
      - `cryptographic_binding_methods_supported` string[] — You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.
      - `format` string — Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.
      - `proof_types_supported` object — You receive proof types the credential endpoint accepts.
        - `jwt` object — Use this JWT (JSON Web Token) proof type for holder proof-of-possession.
          - `proof_signing_alg_values_supported` string[] — You receive the proof signing algorithms this issuer accepts.
      - `vct` string — You receive the VCT (Verifiable Credential Type) for this configuration.
    - `EmployeeBadge` object — Use this captured configuration to request an EmployeeBadge credential.
      - `credential_signing_alg_values_supported` string[] — You receive the credential signing algorithms this issuer supports.
      - `cryptographic_binding_methods_supported` string[] — You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.
      - `format` string — Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.
      - `proof_types_supported` object — You receive proof types the credential endpoint accepts.
        - `jwt` object — Use this JWT (JSON Web Token) proof type for holder proof-of-possession.
          - `proof_signing_alg_values_supported` string[] — You receive the proof signing algorithms this issuer accepts.
      - `vct` string — You receive the VCT (Verifiable Credential Type) for this configuration.
    - `MembershipCard` object — Use this captured configuration to request a MembershipCard credential.
      - `credential_signing_alg_values_supported` string[] — You receive the credential signing algorithms this issuer supports.
      - `cryptographic_binding_methods_supported` string[] — You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.
      - `format` string — Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.
      - `proof_types_supported` object — You receive proof types the credential endpoint accepts.
        - `jwt` object — Use this JWT (JSON Web Token) proof type for holder proof-of-possession.
          - `proof_signing_alg_values_supported` string[] — You receive the proof signing algorithms this issuer accepts.
      - `vct` string — You receive the VCT (Verifiable Credential Type) for this configuration.
    - `StudentID` object — Use this captured configuration to request a StudentID credential.
      - `credential_signing_alg_values_supported` string[] — You receive the credential signing algorithms this issuer supports.
      - `cryptographic_binding_methods_supported` string[] — You receive the holder binding methods this issuer supports. `jwk` means JWK (JSON Web Key) binding.
      - `format` string — Use this `dc+sd-jwt` format for SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuance.
      - `proof_types_supported` object — You receive proof types the credential endpoint accepts.
        - `jwt` object — Use this JWT (JSON Web Token) proof type for holder proof-of-possession.
          - `proof_signing_alg_values_supported` string[] — You receive the proof signing algorithms this issuer accepts.
      - `vct` string — You receive the VCT (Verifiable Credential Type) for this configuration.
  - `credential_endpoint` string, uri — Call this endpoint to redeem a holder proof for the issued credential.
  - `credential_issuer` string, uri — Use this issuer identifier as the audience for holder proofs.
  - `jwt_vc_issuer` string, uri — Fetch this URL to get the SD-JWT VC (Selective-Disclosure JWT Verifiable Credential) issuer metadata and JWKS (JSON Web Key Set).
  - `nonce_endpoint` string, uri — Call this endpoint to mint the nonce for the holder proof.
  - `token_endpoint` string, uri — Call this endpoint to exchange the pre-authorized code for an issuance access token.

## Other responses

- `404` — No tenant exists for the given slug (or it is soft-deleted).

---

[API](https://skmtc.net/didit-protocol/apis/didit-credentials-api.md) · [All operations](https://skmtc.net/didit-protocol/apis/didit-credentials-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/didit-protocol/didit-credentials-api/revisions/e4eddba66557/schema)