EUDI Wallet · Sign-in · W3C Digital Credentials API
Sign in with your EUDI wallet.
Straight from the browser.
On the CodeB sign-in page your browser can ask your wallet app directly – no QR code to scan, no link to copy. The browser shows which wallets can answer, your wallet shows who is asking and what, and the answer goes encrypted to the website that asked. This uses the W3C Digital Credentials API.
W3C Digital Credentials API · OpenID4VP 1.0 (signed and unsigned requests, dc_api.jwt) · ISO/IEC TS 18013-7 Annex C (org-iso-mdoc) · SD-JWT VC · ISO mdoc
Shown on the sign-in page only where the browser supports it; the QR code stays for every other browser.
In short
- What
- Sign-in with your European digital identity (EUDI): your browser hands the request of the website to a wallet app on your device and returns the answer – the W3C Digital Credentials API.
- Where
- On the CodeB sign-in page (EU Wallet sign-in) and therefore for every application that signs people in with CodeB’s OpenID Connect with the EU wallet.
- You need
- A browser that offers the API (for example current Chrome on Android) and a wallet app that answers it, such as CodeB Wallet for Android.
- Shares
- Only what the website asks for and you confirm: for the sign-in your name from the PID, or your CodeB sign-in card.
- Protection
- The answer is encrypted to the website and bound to its web address by the browser; the website signs its request.
- Otherwise
- Browsers without the API keep the QR code and the “open wallet” link – nothing changes there.
How it works
Three steps. The browser does the hand-over instead of a QR code.
Choose “Use a wallet via this browser”
On the sign-in page, the button appears when your browser supports the Digital Credentials API. The website prepares a request for this one sign-in.
Pick your wallet and confirm
The browser and your phone show the wallets that can answer. Your wallet shows who is asking, whether they are verified and exactly which details; you share or decline.
Signed in
The encrypted answer goes back through the browser to the website, which checks it like every wallet answer and signs you in.
Why it is safe
Bound to the website
The browser adds the web address of the page to the request, and the wallet binds its answer to it. An answer made for another website does not work here.
Encrypted
The answer is encrypted to a key made for this one sign-in (dc_api.jwt, or HPKE for ISO mdoc). Only the website that asked can read it.
The website proves who it is
The request is signed with the website’s certificate, the same as for the QR code. Your wallet checks it before it shows anything.
Same checks as always
Issuer signature, holder key, nonce and revocation are checked exactly as for a QR-code sign-in. An unencrypted answer is refused.
Only what is needed
Selective disclosure: the request names the details, for the sign-in only your name or your sign-in card.
No tracking
No third-party scripts and no analytics on the sign-in page; the browser API runs locally between your browser and your wallet.
Protocols
The website offers several request formats; the browser and your wallet use one they both support.
| Protocol | What it is | Used for |
|---|---|---|
openid4vp-v1-signed | OpenID4VP 1.0 (Appendix A) request signed by the website, response mode dc_api.jwt, expected_origins | PID or CodeB sign-in card, SD-JWT VC and ISO mdoc |
openid4vp-v1-unsigned | The same request without a signature, for wallets that only take unsigned requests | as above |
org-iso-mdoc | ISO/IEC TS 18013-7 Annex C: DeviceRequest with reader authentication, HPKE-encrypted DeviceResponse | PID in ISO mdoc format |
Questions and answers
What is the W3C Digital Credentials API?
A browser interface (navigator.credentials.get with a digital request) through which a website asks a wallet on the same device for a credential. The browser and the operating system show the wallets that can answer and return the wallet's answer to the website. It replaces the QR code and the custom link.
Do I still need a wallet app?
Yes. The browser only passes the request on; a wallet app answers it. CodeB Wallet for Android answers these requests (setting “Offer my documents to websites and apps”, on by default). A web page cannot act as a wallet for this API, so the CodeB web wallet keeps using the QR code or link.
Which browsers support it?
Browsers that offer the Digital Credentials API, for example current Chrome on Android. The sign-in page checks this itself and shows the button only where it works.
What if my browser does not support it?
Nothing changes: scan the QR code with your wallet, or open the wallet with the link on the same device.
Is it safe?
Yes. The browser binds the answer to the web address of the page, the answer is encrypted to a key made for this sign-in, and the website signs its request. The website checks the answer exactly as it checks a QR-code sign-in.
Which protocols are used?
OpenID4VP 1.0 as defined for the Digital Credentials API (signed and unsigned requests, encrypted dc_api.jwt answers) and ISO/IEC TS 18013-7 Annex C (org-iso-mdoc) for the PID in ISO mdoc format.
Do relying parties have to change anything?
No. Applications that sign people in with CodeB's OpenID Connect and the EU wallet (acr urn:codeb:acr:eudi-wallet) reach the same sign-in page; the browser option appears there on its own.
Is the Digital Credentials API a final standard?
It is a W3C draft that browsers already ship. We follow the draft and adapt when it changes.
Is this certified?
No. It follows the published specifications; it is not a certified EUDI Wallet or relying-party product.
Try it now
Open the sign-in page in Chrome on your Android phone with CodeB Wallet installed and choose “Use a wallet via this browser”.