CodeB Wallet Intermediary: the EU Wallet for many relying parties

Register a relying party

Once per customer: a register entry with “uses this site as intermediary” and the gateway client it signs in through.

# Register a relying party that uses your site as intermediary (admin API of the
# access-certificate CA; the same form is on the admin page "Access-certificate CA").
curl -s https://YOUR-SITE/wrpac-ca.ashx?rp \
  -H "Authorization: Bearer ADMIN_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "example-shop",
    "official_name": "Example Shop Ltd",
    "trade_name": "Example Shop",
    "org_id": "VATMT-00000000",
    "country": "MT",
    "url": "https://shop.example",
    "email": "privacy@shop.example",
    "privacy_policy": "https://shop.example/privacy",
    "intended_use": "Age check at checkout",
    "uses_intermediary": true,
    "oidc_client_id": "example-shop-web"
  }'

What the wallet receives

The relying party’s registration certificate names the intermediary; the request itself is signed with the intermediary’s access certificate.

// Payload of the registration certificate the wallet receives (typ rc-wrp+jwt,
// signed by the registrar signer; values illustrative, abridged).
{
  "sub": "VATMT-00000000",            // the relying party - not the intermediary
  "name": "Example Shop",
  "sub_ln": "Example Shop Ltd",
  "country": "MT",
  "intermediary": { "sub": "VATMT-99999999", "sname": "CodeB" },   // ETSI TS 119 475 Table 10
  "act": { "sub": "VATMT-99999999" },                               // GEN-5.2.4-09
  "credentials": [ { "format": "dc+sd-jwt", "meta": { "vct_values": ["urn:eudi:pid:1"] },
                     "claim": [ { "path": ["age_equal_or_over", "18"] } ] } ],
  "purpose": [ { "lang": "en", "value": "Age check at checkout" } ],
  "privacy_policy": "https://shop.example/privacy",
  "registry_uri": "https://YOUR-SITE/wrpac-ca.ashx?registry=example-shop",
  "status": { "status_list": { "idx": 7, "uri": "https://YOUR-SITE/wrpac-ca.ashx?rc-status" } },
  "iat": 1792540800, "exp": 1792627200
}

What the relying party integrates

# The relying party itself only does a standard OpenID Connect sign-in
# (authorization code + PKCE) with its gateway client and asks for the wallet:
https://YOUR-SITE/oauth2/v1/authorize?response_type=code
  &client_id=example-shop-web
  &redirect_uri=https%3A%2F%2Fshop.example%2Fcallback
  &scope=openid
  &acr_values=urn%3Acodeb%3Aacr%3Aeudi-wallet
  &state=...&nonce=...&code_challenge=...&code_challenge_method=S256
# Complete samples for Node.js, Python, PHP and ASP.NET Core: relying-party-quickstart.html

Public register entry

# Public register entry (the registry_uri in the certificate) - shows that the
# relying party uses an intermediary and which one (CIR (EU) 2025/848 Annex I points 14-15):
curl -s "https://YOUR-SITE/wrpac-ca.ashx?registry=example-shop"
# { "id": "example-shop", "official_name": "Example Shop Ltd", ...,
#   "uses_intermediary": true,
#   "intermediary": { "sub": "VATMT-99999999", "sname": "CodeB" }, "status": "valid" }