PID issuance flow

Issuance protocol

• The issuer URI to use as base for metadata fetching is "https://preprod.pid-provider.bundesdruckerei.de". The issuer metadata contains the information required to construct the initial authorization request sent by the wallet to start the issuance.
• OpenID for Verifiable Credential Issuance 1.0 is followed.
• Issuance is performed using the authorization code flow with scope parameter and can be initiated by the wallet.
• The use of Pushed Authorization Requests is required.
• The use of PKCE is required.
• The use of Client Attestation is required.
• The use of DPoP is required.
• Key attestation at the token endpoint, as described in the wallet-development-documentation part 29-31 is currently optional.
• Issuance will happen at the credential endpoint, which supports single or batch issuance through the use of the proof or proofs parameter as specified in OpenID for Verifiable Credential Issuance (Draft 15).
• Proof Type jwt (without key attestation) and attestation are supported.
• Deferred issuance and the notification endpoint are not supported.
• The token endpoint issues a refresh token, which can be used at a later point in time to receive a new access token from the token endpoint. This access token can then be used to request fresh credentials from the credential endpoint.
  
  The refresh token is bound to the key that is used for the DPoP header of the token request containing the authorization code. The refresh token can only be used in token requests that have a DPoP header with the same key that was bound to the refresh token.
• Credentials can be issued using the provided test eID cards.