oid4vcwallet/dev.idfoundry.oid4vcwallet/DigitalCredentials

DigitalCredentials

Credential Manager's side of the Digital Credentials API: what an app needs so Chrome, or another app, can ask the wallet for a credential.

register the wallet's credentials after every change, so the system's chooser offers them for the requests they can answer.
Declare an exported activity with an intent filter for androidx.credentials.registry.provider.action.GET_CREDENTIAL. Credential Manager starts it when the holder picks one.
In it, read the request, show it for the holder's consent with Request.startPresentation (or Request.startMdocPresentation), and finish with setResult(Activity.RESULT_OK, intent), where intent is response, or failure when the wallet won't answer.

Android answers Chrome's requests over OpenID4VP (openid4vp-v1-*), for mdocs as well as SD-JWT VCs: the registry's default matcher is OpenID4VP's. org-iso-mdoc (ISO/IEC TS 18013-7 Annex C) is Safari's route, so iOS's, and is only answered here for a web origin.

Types

RegistrationOptions

data class RegistrationOptions(val registryID: String? = null, val claimValues: Boolean = true, val icon: (CredentialSummary) -> Bitmap? = null)

How register describes the wallet's credentials to the system.

Request

class Request

A Digital Credentials API request Credential Manager handed the wallet's activity, from the page or app at origin.

Properties

MDOC_PROTOCOL

const val MDOC_PROTOCOL: String

The org-iso-mdoc protocol identifier.

OPENID4VP_PROTOCOL_PREFIX

const val OPENID4VP_PROTOCOL_PREFIX: String

The OpenID4VP protocol identifiers' prefix (openid4vp-v1-unsigned, -signed, -multisigned).

Functions

failure

fun failure(message: String = "the wallet didn't answer"): Intent

The result intent for a request the wallet doesn't answer: declined, unparseable, or refused. The caller learns only that there's no credential.

suspend fun register(context: Context, wallet: Wallet, options: DigitalCredentials.RegistrationOptions = RegistrationOptions()): Int

Registers the wallet's presentable credentials with Credential Manager — each unexpired SD-JWT VC and mdoc whose key is on the device, with its claims — replacing what was registered before, and returns how many. Call it after every issuance, deletion and restore. It throws where the device has no Credential Manager registry (no Google Play services, say): the wallet then works as before, but isn't offered for Digital Credentials API requests. Nothing is presented by registering: the holder still consents in the app.

request

fun request(intent: Intent, privilegedBrowsers: String): DigitalCredentials.Request?

The Digital Credentials API request in intent, the one Credential Manager started the activity with: its first OpenID4VP request, else its first org-iso-mdoc one. Null when there's none, or when the caller's origin can't be established — a browser not on privilegedBrowsers (Credential Manager's JSON allowlist of browsers trusted to report a page's origin, such as the one Google publishes for Chrome), or an app without a signing certificate. A wallet answers a null with failure.

response

fun response(request: DigitalCredentials.Request, response: MdocPresentation.Response): Intent

The result intent answering request with an org-iso-mdoc presentation's response.

fun response(request: DigitalCredentials.Request, dcapiResponse: String): Intent

The result intent answering request with an OpenID4VP presentation's Presentation.Presented.dcapiResponse.