WaltIdCredentialProvider

Answers the policy server's presentation request from a walt.id wallet: it fetches the presentation definition for the session, authenticates to the wallet, matches credentials and presents them. nautilus opens the session before and checks the verifier's result after (PolicySessionResolver), so this is only needed for assets whose SSIpolicy asks for credentials.

Usage

const  = await .(, {  })
 
const  = await .(, {
  ,
  : new (.(), { 
    : 'https://wallet.example.org'
  }) 
})
 
// Unchanged at the call site — the exchange happens inside.
const {  } = await .({ : 'did:ope:1234abcd...' })

Options

Option	Type	Purpose
`walletApi`	`string`	Wallet API base URL. Required unless `wallet` is given.
`wallet`	`WaltIdWallet`	Supply your own client instead.
`signer`	`Signer`	Authenticate to the wallet with another signer object. Its address must be the consumer's: the provider refuses a session bound to another address.
`walletId`	`string`	Pin a wallet rather than taking the first.
`did`	`string`	Pin a DID rather than taking the first.
`onSelectCredentials`	`(matches, presentationDefinition) => Promise<WaltIdCredential[]>`	Drive selection from a UI. Only credentials among `matches` are presented.
`allowInsecureTransport`	`boolean`	Accept plain `http://` presentation URIs on a non-loopback host. Default `false`.
`onSelectDid`	`(dids) => Promise<string>`	Drive DID choice from a UI.

Methods

`present(challenge)`

Answers the openid4vp request of one session (challenge.sessionId, challenge.redirectUri). nautilus calls it; you do not need to. The request comes from the node, so the provider checks it first, and throws a CredentialPresentationError before the wallet is used when:

the wallet signer is not challenge.consumerAddress;
the request is not an openid4vp:// URL, or its request_uri, response_uri or presentation_definition_uri is not https:// (http:// only on a loopback host, or with allowInsecureTransport), or points at a link-local or cloud metadata address;
an input descriptor of the presentation definition asks for a credential type the asset's or service's request_credentials do not name.

Only wallet credentials of a requested type are presented. It also throws when the wallet holds no such credential (with the ones you are missing), or the request is rejected.

Errors

CredentialPresentationError, with reason saying which step failed:

`reason`	When	`details`
`verifier-rejected`	The wallet posted the presentation and the verifier refused it.	`{ errorMessage }`: the wallet's message
`wallet-failed`	The wallet answered the presentation with an error of its own.	`{ errorMessage }`
`no-matching-credential`	The wallet holds no credential of the requested types that satisfies the presentation definition.	what is missing
`none-selected`	`onSelectCredentials` chose none of the matches.
`wallet-setup`	No wallet session, wallet or DID, or the wallet is another account's.
`request-invalid`	The presentation request or definition was refused before anything was presented (the checks above).

details.errorMessage is walt.id's errorMessage only (or, for an error the wallet's own error handler answers, such as a malformed request, that answer's message), without control characters, credentials redacted, at most 500 characters. The wallet answers a refused presentation with the verifier's error page as redirectUri, which carries the policy-server session id: it is dropped. The session id is also redacted wherever the wallet's text quotes it (walt.id's verifier does for an expired or unknown session: Id parameter <redacted> doesn't refer to an existing session), so neither the message nor details holds it. A URL quoted in the text keeps its origin, so the verifier's host can appear. Turn on NAUTILUS_DEBUG=sensitive with the wallet topic to see the wallet's whole answer (debugging).

A verifier-rejected error rarely reaches you: nautilus then reads the verifier's record of the session and, when it names the failed policies, throws a PolicyDeniedError with them in policyResults and this error as its cause (see PolicySessionResolver). For the other reasons the wallet failed before the verifier, and the error is thrown as it is.

Sessions are cached by nautilus, not by the provider: see MemorySessionStore.

See credential-gated assets.

Suggest changes to this page