OID4VP vs. OpenID Connect
OpenID Connect (OIDC) and OpenID for Verifiable Presentations (OID4VP) both use OpenID and OAuth patterns, but they answer different questions. OIDC returns an authentication result from an OpenID Provider. OID4VP lets a verifier request and receive credentials presented from a wallet.
An application may use either protocol or combine them, depending on whether it needs an account login, a credential presentation, or both.
Compare the protocol roles
| OpenID Connect | OpenID for Verifiable Presentations | |
|---|---|---|
| Main job | Authenticate a user through an OpenID Provider | Request and receive one or more credential presentations from a wallet |
| Primary response | ID Token, and optionally an Access Token | vp_token containing presentations |
| Who asserts the result | OpenID Provider | Credential issuer signs the credential; wallet presents it; verifier validates it |
| Typical client | Application relying on an identity provider for login | Relying party requesting credential evidence from a wallet |
| Trust checks | Validate the provider, ID Token, issuer, audience, nonce, and claims | Validate each credential, issuer trust, requested claims, and format-specific holder or device proof |
This is a protocol-level distinction. Implementations may use additional profiles, identity systems, or application checks.
What OIDC is used for
OIDC is an identity layer on OAuth 2.0. A client sends an authentication request to an OpenID Provider and validates the returned ID Token. The token communicates information about the authentication event and the subject in the scope of that provider and client.
Use OIDC when the user signs in to an application through an identity provider, or when the application relies on an existing provider account and its authentication policy.
What OID4VP is used for
OID4VP defines a way for a verifier to request and receive presentations of credentials held by a wallet. The wallet response contains presentation data; the relying party validates the credential issuer, requested claims, and format-specific proofs before using the result.
Use OID4VP when the application needs a user to present a credential or attribute from a wallet, such as person identification data, a mobile driving licence, or another supported attestation. OID4VP does not create a logged-in application session by itself.
Can an application use both?
Yes. OpenID4VP is based on OAuth 2.0 and can be combined with OpenID Connect deployments when an application needs both the OIDC authentication features and a wallet credential presentation. Keep the two results distinct:
- use OIDC to establish or continue the application login;
- use OID4VP to request and validate wallet-presented evidence;
- bind each transaction to the right account and purpose using the security controls defined by the relevant profiles;
- apply the service's own authorization and eligibility policy after validating each result.
One protocol response should not be treated as proof that the other flow has completed. For example, an ID Token does not prove that a requested wallet credential was presented, and a valid credential presentation does not by itself establish an application login session.
OID4VP implementation resources
- OID4VP overview and presentation flow
- Nonce and state validation
- SD-JWT VC vs. ISO mdoc
- DLBR OID4VP verification API