Authorization Server

Generate attestation challenge Endpoint

post

Initiates an attestation process by generating a challenge that the Wallet must sign to prove possession of a key or credential. The resulting signed attestation can then be submitted to complete the credential issuance or binding process.

Purpose

This endpoint enables the Issuer to verify the authenticity and integrity of the Wallet or Holder before issuing a Verifiable Credential.

Typical Flow

1. The Wallet requests a challenge from the Issuer.

2. The Issuer returns a challenge (e.g., nonce, payload, or proof request).

3. The Wallet signs the challenge using its private key and returns the attestation proof to the Issuer.

Supported Standards

• OAuth 2.0 Attestation-Based Client Authentication

Authorizations

bearerAuthmutualTLS

AuthorizationstringOptional

Bearer authentication header of the form Bearer <token>.

Responses

200

OK

application/json

attestation_challengestringRequired

400

Invalid request / Too many requests

application/json

500Error

application/json

503Error

application/json

post/challenge

HTTPcURLJavaScriptPython

POST /challenge HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "attestation_challenge": "text"
}

JSON Web Keys Endpoint

get

Host the JSON Web Key Set (JWKS) used to validate access tokens issued by the Wallet.

Responses

200

JSON Web Key Set

application/json

keysobject[]Optional

JSON Web Key

get/jwks

HTTPcURLJavaScriptPython

GET /jwks HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Accept: */*

200

JSON Web Key Set

{
  "keys": [
    {
      "alg": "ES256",
      "crv": "P-256",
      "kid": "ritDgnA8wOtvFEA3pd2AEGom7vgGgCwKH1gfhQUkY1k",
      "kty": "EC",
      "use": "sig",
      "x": "M4CRKG-wiOTEnTNqQ89fOz3gzznbNroG47FhbYLMZaE",
      "y": "p0BZN0a-2t9NTV40xU3uVaac-mHqC4zUYUS9nfLxink"
    }
  ]
}

Authorization Endpoint

get

Authorization Request endpoint as specified in the OpenID for Verifiable Credential Issuance specification.

Supports wallet-initiated issuance requests via scope as per Section 5.1.2 of OID4VCI

Supported Standards

• OpenID for Verifiable Credential Issuance 1.0 (Section 5)

• RFC 6749 - The OAuth 2.0 Authorization Framework

• RFC 7636 - OAuth 2.0 Proof Key for Code Exchange (Section 4.3)

• RFC 9396 - OAuth 2.0 Rich Authorization Requests

Query parameters

client_idstringRequired

A unique identifier for the client

response_typestring · enumOptional

Inform the authorization server of the desired grant type. MUST be code, which is used to initiate the authorization code flow

Possible values:

scopestring · enumOptional

Scope of the access request. Can be used to communicate credential template(s) to be issued.

Possible values:

redirect_uristringRequired

The URI to which the authorization server will redirect the user-agent with the authorization code after the authorization is completed

code_challengestringOptional

Code challenge generated by the client's code verifier. MUST be used with code_challenge_method

code_challenge_methodstring · enumOptional

The method used to dervice the code challenge. MUST be S256

Possible values:

issuer_statestringOptional

Issuer state as provided in the credential offer claim grants.authorization_code.issuer_state. Required if the offer contained issuer_state.

request_uristringOptional

Reference to the request object as returned by the Pushed Authorization Request (PAR) endpoint

authorization_detailsstringOptional

Serialized array of authorization details object defined in Section 2 of [RFC9396] used to convey the details about the Credentials the Wallet wants to obtain

connectionstring · enumOptional

Custom reference to the IDP that will be used for bridge interaction

Possible values:

account_claimsstringOptional

Custom parameter to allow account based claims to be passed between bridge components. It is a comma separated list of claim names.

Responses

303

Redirect to Authentication page. In case of error, response redirects to the URI provided via redirect_uri paramter with error and error_description properties. Possible error values:

• invalid_request
• invalid_grant
• invalid_scope
• invalid_client
• unauthorized_client
• unsupported_grant_type
• server_error
• temporary_unavailable

400

Request is invalid and redirect_uri property was not provided

application/json

500

Internal Server Error. Unexpected error occurred.

application/json

503Error

application/json

get/authorize

HTTPcURLJavaScriptPython

GET /authorize?client_id=text&redirect_uri=text HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Accept: */*

No content

Pushed Authorization Request Endpoint

post

Pushed Authorization Request endpoint as defined in RFC 9126 - OAuth 2.0 Pushed Authorization Request (PAR)

Used in the OpenID4VCI Authorization Code Flow, it supports a more secure way of sending the authorization request. Upon successfully verifying the request, it returns a request_uri which can be used in a subsequent call to the /authorize endpoint.

Its usage is highly recommended in general, but mandatory when require_pushed_authorization_requests is set to true in the Authorization Server Metadata.

Body

application/x-www-form-urlencoded

client_idstringRequired

A unique identifier for the client

response_typestring · enumRequired

Inform the authorization server of the desired grant type. MUST be code, which is used to initiate the authorization code flow

Possible values:

scopestring · enumRequired

Scope of the access request. Can be used to communicate credential template(s) to be issued.

Possible values:

redirect_uristringRequired

The URI to which the authorization server will redirect the user-agent with the authorization code after the authorization is completed

code_challengestringRequired

Code challenge generated by the client's code verifier. MUST be used with code_challenge_method

code_challenge_methodstring · enumRequired

The method used to dervice the code challenge. MUST be S256

Possible values:

issuer_statestringRequired

Issuer state as provided in the credential offer claim grants.authorization_code.issuer_state. Required if the offer contained issuer_state.

connectionstring · enumOptional

Custom reference to the IDP that will be used for bridge interaction

Possible values:

account_claimsstringOptional

Custom parameter to allow account based claims to be passed between bridge components. It is a comma separated list of claim names.

Responses

200

Redirect URI that can be used in the /authorize endpoint

application/json

request_uristringOptional

400

The request could not be processed due to invalid input. Refer to the detailed error codes and descriptions for more information.

application/json

500Error

application/json

503Error

application/json

post/par

HTTPcURLJavaScriptPython

POST /par HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 209

"client_id='text'&response_type='code'&scope='openid'&redirect_uri='text'&code_challenge='text'&code_challenge_method='S256'&issuer_state='text'&connection='connect_id'&account_claims='text'"

{
  "request_uri": "text"
}

Token Endpoint

post

Token endpoint for OpenID for Verifiable Credential Issuance (OID4VCI). Exchanges either a Pre-Authorized Code or Authorization Code for an access token used to obtain verifiable credentials from the Credential Endpoint.

Flows

Grant Type	Required Parameters
urn:ietf:params:oauth:grant-type:pre-authorized_code	pre-authorized_code, tx_code (if required by the issuer)
authorization_code	code, redirect_uri, code_verifier (PKCE)

Supported Standards

• OpenID for Verifiable Credential Issuance 1.0 (Section 6)

• RFC 6749 - The OAuth 2.0 Authorization Framework

• RFC 7636 - OAuth 2.0 Proof Key for Code Exchange (Section 4.5)

Body

application/x-www-form-urlencoded

grant_typestring · enumRequired

The type of grant being requested.

Possible values:

pre-authorized_codestringOptional

The pre-authorized code from the credential offer. Required when grant_type is urn:ietf:params:oauth:grant-type:pre-authorized_code.

tx_codestringOptional

Transaction code. Required if a tx_code object was present in the credential offer. The transaction code itself should be sent via a separate channel.

codestringOptional

Authorization code. Required when grant_type is authorization_code.

redirect_uristringOptional

Required when grant_type is authorization_code.

code_verifierstringOptional

PKCE code verifier. Used with authorization_code grant type.

client_idstringOptional

Client identifier. Optional for pre-authorized code flow when client authentication is not required.

client_secretstringOptional

Client secret for client_secret_post authentication.

client_assertionstringOptional

Client assertion JWT for private_key_jwt authentication.

client_assertion_typestring · enumOptional

Type of client assertion.

Possible values:

Responses

200

OK

application/json

access_tokenstringRequired

The access token issued by the authorization server.

token_typestringRequired

The type of the token issued.

Example: DPoP

expires_inintegerRequired

The lifetime in seconds of the access token.

Example: 3600

400

Invalid request / grant / scope or unsupported grant type or invalid scope or authorization is pending

application/json

500Error

application/json

503Error

application/json

post/token

HTTPcURLJavaScriptPython

POST /token HTTP/1.1
Host: zyfla-wallet-sandbox.meeco.cloud
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 323

"grant_type='urn:ietf:params:oauth:grant-type:pre-authorized_code'&pre-authorized_code='text'&tx_code='text'&code='text'&redirect_uri='text'&code_verifier='text'&client_id='text'&client_secret='text'&client_assertion='text'&client_assertion_type='urn:ietf:params:oauth:client-assertion-type:jwt-bearer'"

{
  "access_token": "text",
  "token_type": "DPoP",
  "expires_in": 3600
}