OID4VCI `jwt_vc` credential format #45074

sberyozkin · 2025-12-23T18:15:23Z

sberyozkin
Dec 23, 2025

Hello,

I've been experimenting with a jwt_vc credential format, as an alternative to dc+sd-jwt. I guess jwt_vc can likely be useful in traditional verifier implementations which already know how to handle JWT bearer tokens, without having to upgrade to support SD-JWT.

I'd only like to clarify a couple of questions.

I recall I saw jwt_vc in one of the Keycloak discussions or issues but I tried jwt_vc_json first, see https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html#appendix-A.1, but this format is not recognized, only jwt_vc is. Perhaps jwt_vc was introduced by one of the specification drafts ?
This is what I have Keycloak returning if it is a jwt_vc:

{
  "nbf": 1766506399,
  "jti": "urn:uuid:8dcaa111-ba6a-421e-bbed-059d5c892318",
  "iss": "https://localhost:8443/realms/software-credentials",
  "vc": {
    "type": [
      "JavaCoderChampion"
    ],
    "issuer": "https://localhost:8443/realms/software-credentials",
    "issuanceDate": 1766506399.267,
    "credentialSubject": {
      "nbf": 1766506399,
      "last_name": "Brown",
      "first_name": "Alice",
      "iat": 1766506399,
      "username": "alice"
    },
    "@context": [
      "https://www.w3.org/ns/credentials/v1"
    ]
  }
}

Note, the VC related data are enclosed in the vc claim, while https://www.w3.org/TR/vc-jose-cose/#jose-header-parameters-jwt-claims insists that The JWT Claim Names vc and vp MUST NOT be present.

This is probably a version related mismatch as well ?

Thanks

Navigation Menu

Repository navigation

OID4VCI `jwt_vc` credential format #45074

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

OID4VCI jwt_vc credential format #45074

Uh oh!

Uh oh!

sberyozkin Dec 23, 2025

Replies: 0 comments

OID4VCI `jwt_vc` credential format #45074

sberyozkin
Dec 23, 2025