Nonce Endpoint for Authorization Server
Open
@c2bo is already working on this.
Since May 19, 2025.
discuss
post-wglc-is-ok
- Dominant language
- No language data
- Stars
- 125
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Description
Given our latest proposal for nonce fetching for Wallet Attestation, we propose to have a nonce endpoint for the Authorization Server in OpenID4VCI. Our reasoning:
- we already have a nonce endpoint for Credential Issuer
- we can use the nonce endpoint at AS to get nonces for wallet attestation before calling the PAR endpoint
- we can fetch DPoP nonces also at AS, which would bring us on par with pending PR #478
- if AS and Credential Issuer are the same, they can have a merged nonce endpoint
- in the long run extract the ideas from OpenID4VCI and Attestation-Based Client Authentication into a dedicated OAuth Draft in backwards-compatible fashion?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.