Relying parties · OpenID4VP · OIDC · eIDAS 2.0
CodeB EUDI Gateway – one connection for every EU wallet
Every EU country ships its own wallet, on its own date, and keeps updating it after launch. For a bank, a shop or a public service, accepting them is a job that never finishes. The CodeB EUDI Gateway on phone.codeb.io takes that job: your website connects once, with standard OpenID Connect, and the gateway speaks to the wallets.
- One integration
- OpenID Connect for your app
- Evidence for every request
Why one connection matters
The EU Digital Identity Wallets do not arrive all at once. Countries launch in stages, add documents later and change their wallets after launch. Each change can touch the protocol, the formats or the trust lists your website relies on.
Without a gateway, every relying party has to follow all of this itself: register as an organisation that asks for wallet data, prove to each wallet that it may ask, check that the wallet is genuine, keep a record of every request – and do it again with every update.
What the gateway does for you
Standard sign-in for your app: your website uses OpenID Connect, as with any other login. The gateway speaks OpenID4VP 1.0 with the HAIP profile, SD-JWT VC and ISO mdoc to the wallet and hands your app a signed id_token with only the data you asked for. gateway documentation.
Trust and revocation: the gateway checks the issuer signatures against the trust lists, the status lists for revoked documents and that the data was not changed.
The same fields from every country: for the PID as SD-JWT VC from wallets that follow ARF 3.0, your app reads the same standard OpenID Connect claims (such as given_name, family_name, birthdate and address) from the UserInfo endpoint, whichever country or issuer it comes from – no country-specific mapping on your side. Other wallet attributes are released only when enabled for your client. Claim list.
Registration: as a wallet intermediary, the gateway asks on behalf of many organisations, each with its own registration certificate (ETSI TS 119 475) that the wallet shows to the user.
Evidence: every request is kept as a hash-chained evidence record – what was asked, why, and what the wallet answered.
Customers without a wallet yet: the same gateway reads the chip of their passport or ID card through their Android phone – remote ID verification.
How to start
One script tag: the sign-in widget demo shows a “Sign in with EU Wallet” button you can put on any page.
OpenID Connect samples for common platforms: integration cookbook.
Try it first: read your own ID chip or prove your age on the playground, and test any wallet with the interoperability self-test.
Age checks that reveal nothing else
Online services with age limits – under the Digital Services Act, for example – can ask only “over 18?”. The gateway supports the EU age-verification link: the wallet answers yes or no from the PID or an age attestation, without birth date or name, and the person sees that nothing else is asked. Try it on the age check page or read Prove your age.
Issue your own credentials
The same platform also issues: membership cards, access cards for doors and PCs, PKI cards and other attestations go straight into the person’s wallet with OpenID4VCI, signed by your organisation. They are ordinary electronic attestations of attributes (EAA) – CodeB is not a qualified trust service provider, so it does not issue qualified attestations (QEAA).
Where the gateway stands today
The gateway is designed to follow eIDAS 2.0 and the EU Architecture and Reference Framework. It is not certified. Access certificates are issued by CodeB’s own test CA under its own policy (certificate policy), not yet by a national registrar. Connection to a hardware security module (HSM) is planned as part of the certification process.
It is tested against the EU reference wallet and other wallets that follow the standards; the national wallets are tested as they become available. A chip reading proves that a genuine document was present – not who is holding it. Strong customer authentication for payments (PSD2) will follow as soon as the EU Commission publishes its rulebook.
Bank IDs are not part of the gateway.
Questions about the CodeB EUDI Gateway
What is the CodeB EUDI Gateway?
A service on phone.codeb.io that lets a website accept the EU Digital Identity Wallets with one integration. Your app uses OpenID Connect; the gateway handles OpenID4VP, the data formats, trust and revocation checks, registration and evidence records.
Do I have to change my integration when a wallet updates?
No. The gateway follows the wallets and the standards; your OpenID Connect integration stays the same.
Which data formats does it support?
SD-JWT VC and ISO mdoc over OpenID4VP 1.0 with the HAIP profile, as used by the EU Digital Identity Wallets.
Is the gateway certified?
No. It is designed to follow eIDAS 2.0 and the EU Architecture and Reference Framework, but it has not been certified, and its access certificates come from CodeB’s own test CA.
Can the gateway check only someone’s age?
Yes. With the EU age-verification link the wallet shares only the answer to “over 18?” (or another age), nothing else – no birth date, no name.
Can my organisation issue its own credentials to EU wallets?
Yes – membership, access and PKI cards and other attestations, with OpenID4VCI, signed by your organisation. They are non-qualified attestations (EAA); for qualified attestations you need a qualified trust service provider.
Does it support bank IDs?
No. The gateway is for the EU Digital Identity Wallets and for reading the chip of passports and ID cards.