WaltIdCredentialProvider

Answers the policy server's presentation request from a walt.id wallet: it fetches the presentation definition for the session, authenticates to the wallet, matches credentials and presents them. nautilus opens the session before and checks the verifier's result after (PolicySessionResolver), so this is only needed for assets whose SSIpolicy asks for credentials.

Usage

const  = await .(, {  })
 
const  = await .(, {
  ,
  : new (.(), { 
    : 'https://wallet.example.org'
  }) 
})
 
// Unchanged at the call site — the exchange happens inside.
const {  } = await .({ : 'did:ope:1234abcd...' })

Options

Option	Type	Purpose
`walletApi`	`string`	Wallet API base URL. Required unless `wallet` is given.
`wallet`	`WaltIdWallet`	Supply your own client instead.
`signer`	`Signer`	Authenticate to the wallet with another signer object. Its address must be the consumer's: the provider refuses a session bound to another address.
`walletId`	`string`	Pin a wallet rather than taking the first.
`did`	`string`	Pin a DID rather than taking the first.
`onSelectCredentials`	`(matches, presentationDefinition) => Promise<WaltIdCredential[]>`	Drive selection from a UI. Only credentials among `matches` are presented.
`allowInsecureTransport`	`boolean`	Accept plain `http://` presentation URIs on a non-loopback host. Default `false`.
`onSelectDid`	`(dids) => Promise<string>`	Drive DID choice from a UI.

Methods

`present(challenge)`

Answers the openid4vp request of one session (challenge.sessionId, challenge.redirectUri). nautilus calls it; you do not need to. The request comes from the node, so the provider checks it first, and throws a CredentialPresentationError before the wallet is used when:

the wallet signer is not challenge.consumerAddress;
the request is not an openid4vp:// URL, or its request_uri, response_uri or presentation_definition_uri is not https:// (http:// only on a loopback host, or with allowInsecureTransport), or points at a link-local or cloud metadata address;
an input descriptor of the presentation definition asks for a credential type the asset's or service's request_credentials do not name.

Only wallet credentials of a requested type are presented. It also throws when the wallet holds no such credential (with the ones you are missing), or the request is rejected.

Sessions are cached by nautilus, not by the provider: see MemorySessionStore.

See credential-gated assets.

Suggest changes to this page