Credential Issuer: Who Issues EUDI Wallet Credentials

A credential issuer, also known as an attester in the eIDAS 2.0 terminology, is an authorized organization that creates, cryptographically signs, and delivers verifiable credentials to EUDI Wallets. The issuer attests to the truthfulness of the claims within the credential -- for example, that a person was born on a certain date, holds a specific degree, or is licensed to practice a profession. Credential issuers are one of the three core roles in the EUDI trust triangle, alongside wallet holders and relying parties (verifiers).

The eIDAS 2.0 framework defines a hierarchy of issuer types based on the assurance level of the credentials they produce:

• •PID Providers: Government agencies authorized to issue Person Identification Data -- the core identity credential containing name, date of birth, nationality, and a unique identifier. Each member state designates one or more PID providers. Examples include the Bundesdruckerei in Germany, ANTS in France, and the RvIG in the Netherlands.
• •QEAA Issuers: Organizations certified to issue Qualified Electronic Attestations of Attributes. These carry the highest trust level for non-PID credentials and have legal equivalence to their physical counterparts. Examples include driving license authorities, universities issuing diplomas under the European Learning Model, and healthcare authorities issuing European Health Insurance Cards.
• •EAA Issuers: Providers of non-qualified Electronic Attestations of Attributes. These have lower regulatory requirements but still participate in the trust framework. Examples include employers issuing employee badges, membership organizations, and commercial service providers.

The EUDI Wallet uses the OpenID for Verifiable Credential Issuance (OpenID4VCI) protocol for all credential issuance. The protocol supports two flows:

Authorization Code Flow: The most common flow, where the user initiates issuance through the wallet. The wallet directs the user to the issuer's authentication page, where they verify their identity (using eID card, biometrics, or existing credentials). After authentication, the issuer provides an authorization code that the wallet exchanges for the credential. This flow ensures the user actively consents to receiving the credential.

Pre-authorized Code Flow: Used when the issuer initiates the issuance -- for example, when a university wants to push a diploma to a graduate's wallet. The issuer generates a pre-authorized code (often as a QR code or deep link) that the user scans with their wallet. The wallet then retrieves the credential using this code without a separate authentication step.

In both flows, the wallet generates a cryptographic key pair and includes the public key in the credential request. The issuer embeds this public key in the credential, binding it to the wallet's device. The credential is signed with the issuer's private key, creating a verifiable chain from the credential content through the issuer to the EU Trusted List.

• •Ministry of Interior (ID cards): Issues the Person Identification Data credential containing the citizen's legal identity
• •Universities (diplomas): Issue academic credential attestations under the European Learning Model standard
• •Healthcare authorities (vaccination records): Issue health credentials following EU Digital COVID Certificate-style standards
• •Driving license authorities: Issue mobile driving licenses (mDL) in ISO 18013-5 mdoc format