OID4VP nonce and state validation

OID4VP responses arrive from a wallet after the relying party has created an authorization request. The verifier must establish that the response belongs to that request and was created for the intended verifier. A valid signature alone does not establish either fact.

What each value binds

nonce binds a holder-bound presentation to the verification request. OID4VP requires a fresh, unpredictable nonce for each authorization request.
client_id identifies the verifier. The holder proof must be bound to the intended verifier so a captured presentation cannot be replayed to a different party.
state correlates the authorization response with the verifier's session. The verifier checks the returned value against the value stored for that session.

The credential format determines how holder binding is represented. An SD-JWT-based presentation uses a Key Binding JWT; an mdoc presentation uses device authentication over the OID4VP session transcript. The verifier checks the format-specific proof against the expected request values.

Keep request state with the server-side session

Create a session through the SDK and send only its public wallet request URL to the client:

import { EidClient } from "@dlbr/eid-sdk";

const id = new EidClient({
  baseUrl: process.env.DLBR_ID_BASE_URL!,
  apiKey: process.env.DLBR_ID_API_KEY!,
  mode: "test",
});

const session = await id.sessions.create({
  credentials: [{
    format: "vc+sd-jwt",
    issuer_id: "https://issuer.example",
    vct_values: ["urn:eudi:pid:1"],
    claims: ["given_name"],
  }],
});

console.log(session.session_id, session.qr_code_url);

Keep the API key and session management on your backend. Do not accept a client-supplied nonce, state, or verifier identifier as authoritative session state. The Gateway creates and stores request state with the session, then checks the wallet response against it.

Reject mismatched and replayed responses

The verifier must check every presentation in a response against the original request, including holder proof, audience, nonce, and state correlation. A missing or mismatched proof value is a failed verification. Do not treat a presentation as reusable evidence for a second session.

With DLBR, poll the session using the authenticated SDK client and use the result only after its status is VERIFIED:

const result = await id.sessions.get(session.session_id);
console.log(result.status);
if (result.status === "VERIFIED") console.log("Verification completed.");

Delete the session after consuming its result if your workflow no longer needs it. See the SDK quickstarts, the advanced OID4VP guide, and the webhook security guide for the surrounding integration steps.

OID4VP nonce and state validation ​

What each value binds ​

Keep request state with the server-side session ​

Reject mismatched and replayed responses ​

References ​

OID4VP nonce and state validation

What each value binds

Keep request state with the server-side session

Reject mismatched and replayed responses

References