Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
You can prototype verifiable-credential issuance and presentation with a Spring Authorization Server, Spring Boot issuer and verifier services, and a Kotlin Android wallet. The flow combines OAuth authorization-code login with PKCE, a wallet-signed proof for issuance, an SD-JWT credential, and an OpenID for Verifiable Presentations (OpenID4VP) exchange. It is a useful way to learn the protocol boundaries—not, by itself, a production-ready or interoperable digital-wallet system.
The key distinction is that OAuth tokens authorize access to services, while a verifiable credential is an issuer-signed assertion that a holder can later present. The verifier must check more than the issuer’s signature: it must also validate key binding, audience, nonce, expiry, issuer trust, and whether the disclosed claims meet its policy.
What the prototype does
The sample architecture described in the Spring Boot and Android implementation article has four main moving parts: an authorization server, a credential issuer, an Android wallet, and a verifier. An in-memory repository inside the issuer supplies the sample’s user attributes. That makes the data source illustrative, not authoritative.
Free tools Windows power users keep installed
One-click scans. No signup required.
Authentic source → Credential issuer → signed, selectively disclosable credential
↑ ↓
Authorization server ← Android wallet → Verifier request and presentation- Authentic source: Supplies claims the issuer is entitled to assert. In the demo, this is an in-memory repository.
- Issuer: Checks an authorized request, obtains claims, and signs a credential.
- Wallet: The Kotlin Android app that holds credentials and keys, and controls what it discloses.
- Holder: The person or entity controlling the wallet. A holder is often the credential subject, but those roles need not be identical.
- Verifier: Requests specific information and validates the returned presentation.
- Authorization server: Authenticates the user and issues OAuth access tokens used in the issuance flow.
A prototype may place these components in separate Spring Boot services, as the source project does. A monolith can be simpler for a learning exercise. Service boundaries do not, on their own, create separate trust domains or establish that an issuer is trustworthy.
#1 Best Overall
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
Credential, token, and presentation are different things
These terms solve related but distinct problems:
- Application claims are data an application holds about an account. They are not independently verifiable merely because they appear in an API response.
- OAuth access tokens grant a client access under an authorization server’s policy. They are not portable credentials about a person.
- OpenID Connect ID tokens represent an authentication event for a client. An ID token is not automatically a portable, selectively disclosable credential.
- Verifiable credentials (VCs) are issuer-signed assertions about a subject.
- Verifiable presentations (VPs) are holder-mediated disclosures derived from one or more credentials and presented in response to a verifier’s request.
Authentication asks, “Who authenticated?” Authorization asks, “What may this client access?” Credential verification asks whether a trusted issuer made an assertion and whether the presenter controls the credential-bound key. OpenID4VP’s VP token carries presented credentials; it is not simply another ID token.
Pin the protocol and credential profile first
OpenID for Verifiable Credential Issuance 1.0 (OpenID4VCI) and OpenID for Verifiable Presentations 1.0 (OpenID4VP) are published specifications: OpenID4VCI 1.0 and OpenID4VP 1.0. Publication does not guarantee that arbitrary wallets and servers will interoperate. Implementations must agree on the specification revision, credential format, proof type, algorithms, metadata, query syntax, response mode, and trust rules. Some documents referenced by these specifications are themselves version-sensitive.
The source demo uses SD-JWT concepts. Do not treat generic support for SD-JWT as proof of conformance to every requirement of SD-JWT VC or a deployment profile. For example, the OpenID4VC High Assurance Interoperability Profile 1.0, published December 24, 2025, profiles OID4VCI, OID4VP, SD-JWT VC, and ISO mdoc. It does not remove the need to configure trust: the profile leaves trust management and issuer authorization outside its scope.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
- DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
- CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
- PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
- BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.
SD-JWT and SD-JWT VC
SD-JWT is a selective-disclosure mechanism for JWTs. SD-JWT VC is a credential profile that uses SD-JWT concepts. In broad terms, an issuer signs a JWT containing digests for selectively disclosable claims. A disclosure contains a claim and its salt; the holder can release only selected disclosures. The verifier checks the issuer signature and recomputes each disclosed claim’s digest.
This can reduce the amount of data a verifier receives, but it does not make disclosed information anonymous or unlinkable. Stable identifiers, issuer details, credential type, timestamps, and repeated presentation patterns may enable correlation. A verifier still learns every claim the holder reveals. Use the precise format name and requirements supported by the libraries and profile you implement; the source article names Authlete’s SD-JWT library on both backend and Android sides.
Issuing a credential
- Register the Android app as a public client. Configure the authorization server with the client identifier, redirect handling, allowed scopes, and an authorization-code flow using PKCE. A mobile app cannot safely keep a client secret.
- Authenticate and obtain consent. The wallet starts authorization. The authorization server authenticates the user, obtains any required consent, and returns an authorization code to the app’s registered redirect.
- Redeem the code with PKCE. The wallet sends the code and PKCE verifier to the authorization server and receives an access token with the scope needed for credential issuance.
- Create a wallet key pair. Generate a signing key for the wallet. On Android, use Android Keystore-backed protection where available and appropriate; hardware backing and device behavior vary. Keep the private key out of ordinary app storage.
- Make a credential request with proof. The wallet signs a JWT proof with its private key and sends it with the request and access token to the issuer.
- Validate at the issuer. The issuer validates the access token and the proof, including its signature, type, algorithm, key reference or public key, issuer and audience expectations, time bounds, nonce when required, and replay protections. It must ensure the proof key is the key that will be bound to the credential.
- Retrieve claims and issue. The issuer obtains the authorized user attributes from its source, constructs and signs the SD-JWT credential, and binds it to the wallet key—for example, through a confirmation (`cnf`) claim as described by the demo.
- Store securely. The wallet stores the credential and associated key using protected storage and records enough metadata to handle expiry, status, and key availability.
PKCE protects the authorization-code exchange against an intercepted code being redeemed without the verifier. It does not protect an issued credential or prove possession of its bound key. Those are separate controls, provided by wallet key protection and credential proof/key binding.
Rank #3
- YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
- LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
- MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
- NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
- BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.
The issuer should constrain accepted proof algorithms and types rather than allowing untrusted input to select arbitrary cryptographic behavior. It should enforce short, appropriate validity windows and one-time or transaction-bound nonces where the profile requires them. A valid proof signature from a wallet key is not a substitute for checking that the user is authorized to receive the requested credential.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Presenting selected claims
- Create a verifier transaction. The verifier creates a server-side session with a fresh, unpredictable nonce and a unique transaction identifier. Store the expected audience, nonce, expiry, and request policy together.
- Describe what is needed. The request identifies a credential type and, where appropriate, specific claims. The wallet may receive it by same-device redirect, app link, QR code, or a cross-device handoff.
- Match and explain. The wallet finds eligible credentials and displays the verifier’s identity, requested claims, and relevant credential source to the user. It should make clear whether the disclosure is limited to this transaction and avoid implying more than it knows about retention.
- Obtain consent and disclose minimally. The holder chooses whether to proceed. The wallet releases only the disclosures needed to satisfy the request, when the credential format and request support that selection.
- Return a VP token. The wallet packages the presentation and holder-binding proof in the expected response and sends it to the verifier.
- Validate and evaluate. The verifier checks cryptographic and protocol requirements, then separately determines whether the disclosed claims satisfy its business policy. It returns success or rejection for the transaction.
OpenID4VP defines same-device and cross-device scenarios and metadata for credential formats and algorithms a wallet supports. Request syntax is version- and profile-dependent. The original demo describes a JSON Presentation Definition; that is not a universal current request mechanism. OpenID’s digital-credentials work also uses Digital Credentials Query Language (DCQL); consult the OpenID Foundation material on DCQL and the exact OpenID4VP revision and wallet profile you target.
At a conceptual level, a query for a credential type asks whether the wallet has a credential of that kind. A query for particular claims asks for specific data, not just credential possession. A transaction may require one credential to supply all requested claims, or permit claims to be satisfied across multiple credentials; that choice must be explicit in the query and verifier policy. Do not copy a Presentation Definition or DCQL example into a deployment without confirming that the wallet supports the corresponding version, format identifiers, and response behavior.
Rank #4
- PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
- TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
- NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
- MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
- HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Verifier validation checklist
A mathematically valid signature is only one part of acceptance. A verifier should apply both cryptographic and transaction-level checks:
- Issuer signature and trust: Verify the signature using a key obtained from a correctly configured source, and establish that the issuer is authorized for this credential type under the deployment’s trust policy. Unknown keys and untrusted issuers should fail closed.
- Disclosures: Recompute and verify the digest for every disclosed claim. Reject modified or malformed disclosures.
- Holder binding: Verify the binding proof, confirm that it uses the key referenced by the credential, and establish that the presenter controls that key.
- Audience and nonce: Check the expected verifier audience and compare the nonce with the value stored for this exact transaction. Do not accept a nonce merely because it is present.
- Time and status: Enforce issuance, not-before, and expiry rules with a defined clock-skew policy. Check credential status or revocation where the deployment requires it.
- Replay resistance: Reject reused nonces, transaction identifiers, request identifiers, and responses. Correlate the response to the live server-side session.
- Format and policy: Restrict formats and algorithms to configured allowlists. Check the requested credential type and verify that all required claims are present and semantically suitable for the business decision.
- Response handling: Validate the expected response mode and redirect or callback behavior. Treat wallet-supplied values as untrusted input.
OpenID4VP’s transaction correlation requirements mean the nonce and response must be checked against server-side state, not merely logged or displayed. A validly signed date can still fail a business rule, and a valid credential from an issuer the verifier does not trust must not be accepted automatically.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAndroid wallet details that affect security and usability
- Key lifecycle: Generate keys securely, prefer non-exportable Keystore-backed use where possible, and define what happens if the device is replaced, the key becomes unusable, or the user restores from backup. A backup of the credential cannot recreate a non-exportable private key.
- Protected credential storage: Encrypt stored credential material and protect encryption keys. Do not place credentials or tokens in logs, analytics, clipboard, or unprotected preferences.
- Handoff safety: Configure deep links or app links deliberately. Custom URL schemes can be claimed by another app; claimed HTTPS links or a carefully designed QR/cross-device flow may offer a stronger handoff, depending on deployment.
- Consent clarity: Name the verifier, list requested claims, identify the credential source, and explain whether the wallet is disclosing this time only. Avoid a generic “Share credential” confirmation when only a few claims are requested.
- Recovery paths: Give clear outcomes for no matching credential, multiple matches, expired or revoked credentials, unusable keys, user cancellation, network failure, and back navigation. Do not silently fall back to sending more data.
- Device risks: Consider rooted or compromised devices, app tampering, clock skew, offline behavior, and variations in hardware-backed key support. Kotlin and Android provide building blocks, not a standards-compliant wallet automatically.
Spring Boot service responsibilities
| Component | Responsibilities |
|---|---|
| Authorization server | User authentication, public-client registration, PKCE, consent, token issuance, scope and audience controls, signing-key publication and rotation. |
| Credential issuer | Issuer metadata, access-token validation, request and proof validation, attribute retrieval, credential construction and signing, status integration, privacy-conscious audit logging. |
| Verifier | Presentation requests, session and nonce management, wallet handoff, VP-token reception, cryptographic checks, claim-policy evaluation, replay prevention, and result delivery. |
The reference article identifies backend project spring-boot-vci-vp and Android project android-vci-vp, and describes the issuer as a Spring Boot OAuth 2.0 resource server. Use those repositories for the sample’s actual endpoint names and build instructions; do not infer routes, dependency versions, SDK levels, or run commands from the architecture alone. Spring Boot and Spring Security provide useful service and security foundations, but they do not supply a complete VC trust registry or production wallet by themselves (Spring Boot; Spring Security).
Best Value
- Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
- ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
- CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
- PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
- 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US
Negative tests to run before trusting a prototype
| Test input or change | Expected result |
|---|---|
| Alter issuer-signed data or a disclosure | Reject on signature or digest verification. |
| Use an unknown issuer key or untrusted issuer | Reject under issuer trust policy; do not accept merely because a key resolves. |
| Sign holder binding with a different key | Reject because the proof key does not match the credential’s bound key. |
| Change audience or replay a response with the wrong nonce | Reject as a transaction mismatch. |
| Submit an expired credential or proof | Reject under the configured time policy. |
| Reuse a nonce or transaction | Reject as a replay; mark completed transactions unusable. |
| Omit a required claim or present an unsupported credential type | Reject at policy evaluation even if all signatures are valid. |
| Use a disallowed algorithm | Reject before accepting cryptographic results. |
Production gaps and design decisions
The demo is useful for understanding the end-to-end path, but an in-memory attribute store cannot establish real-world data authority. A production issuer needs documented data provenance, rules for who can request issuance, correction procedures, authorization, and auditable operations. Signing keys need controlled custody, rotation, compromise response, and retirement procedures. The verifier needs a defined trust source or issuer allowlist; a cryptographically valid signature alone does not establish issuer authority.
Status and revocation also require an explicit policy. A credential may have a valid signature and still no longer be acceptable. Decide how status is checked, how often, what the verifier does when status infrastructure is unavailable, and what privacy consequences status checks create. Minimize personal data in logs and telemetry; define retention for presentations and consent records; rate-limit issuance and verification endpoints; monitor failures without retaining unnecessary claim values.
Selective disclosure is data minimization, not zero knowledge. Review identifiers and repeated presentations for correlation risk, use pairwise identifiers where the format and architecture allow, and ensure the verifier stores no more than its purpose and legal basis require. Wallet recovery and device migration also need deliberate choices: copying a credential does not necessarily migrate its bound key or preserve assurance.
For interoperability, pin the exact versions of OpenID4VCI, OpenID4VP, credential format/profile, proof type, query language, response mode, algorithms, and metadata behavior. Test with the actual target wallets and verifiers. The 2025 demo is not evidence of compatibility with government, commercial, or EUDI wallets, nor does an OpenID profile alone settle legal compliance or trust management. When portable credentials are unnecessary, conventional OAuth/OIDC may be simpler. Other credential-format options include W3C VC Data Model/JSON-LD and ISO mdoc; choose based on the relying parties and interoperability profile rather than assuming one format fits all.
A prototype can be built with open-source Spring and Android/Kotlin components. The original sample also names Authlete’s SD-JWT library (Authlete); a specialist vendor may help teams seeking supported protocol components, but it is not required for a local proof of concept and does not replace decisions about issuer trust, status, or wallet policy. Official Android and Kotlin documentation is available at Android Developers and Kotlin.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
