Configure an EUDI Wallet issuer backend following the EU Architecture Reference Framework (ARF) for PID credential issuance
domain: europa.eu · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
The EUDI Wallet ecosystem defines Person Identification Data (PID) and Electronic Attestations of Attributes (EAAs); implement an OID4VCI issuer for PID credentials in either SD-JWT VC or mdoc (ISO 18013-5) format as required by the ARF.
Publish issuer metadata at /.well-known/openid-credential-issuer including the pid credential_configuration with format ('vc+sd-jwt' or 'mso_mdoc'), supported claims, and trust framework reference.
Implement PAR (Pushed Authorization Requests, RFC 9126) for the authorization leg; the EUDI High Assurance Interoperability Profile (HAIP) mandates PAR for credential issuance authorization.
Enforce strong user authentication (at minimum LoA High per eIDAS) before issuing PID; integrate with a national identity scheme or qualified trust service provider for authentication.
Sign issued credentials with a key from a Qualified Trust Service Provider (QTSP) certificate; publish the issuer's signing key in a JWKS endpoint and include the x5c (certificate chain) claim so wallets can verify trust.
Known gotchas
The ARF and HAIP profile are still evolving (as of mid-2025); implementation must track the specific ARF version and HAIP profile version the wallet ecosystem you target has certified against — older wallet implementations may not accept newer profile constructs.
PID credentials have strict retention and deletion requirements under GDPR; the issuer backend must not store the credential payload or biometric data after issuance beyond the minimum required for audit.
Cross-border interoperability requires the issuer trust anchor to be registered in the EU Trust List; credentials signed by non-listed issuers will be rejected by conformant wallets.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp