🇩🇪 d-you

Getting an access certificate from the German EUDI Wallet Sandbox

To request credentials from d-you, you need two certificates from the German EUDI Wallet Sandbox registrar. The access certificate says who you are, and authenticates your presentation requests as an X.509 verifier certificate. The registration certificate says which credentials and claims you are registered to request. d-you requires both, and refuses a request that asks for more than the registration certificate lists.

First we need to create a Certificate Signing Request (CSR) with a P-256 key for the access certificate. The Certificate Signing Requests guide contains detailed guidance.

The German EUDI Wallet Sandbox registrar strips the subjectAlternativeName DNS entry from the signed certificate, so you must disable the openId4VpX509SanDns capability on the request. Otherwise Paradym rejects the imported certificate because it no longer matches the request. With the capability disabled the certificate signs OpenID4VP requests using the x509_hash client identifier (OpenID4VP v1).

We recommend creating the Certificate Signing Request through the dashboard as it allows you to download the request as a .pem file to upload to the German EUDI Wallet Sandbox registrar. You can also create the CSR through the API, in which case you save the request contents to a .pem file yourself before uploading.

{
  "countryName": "DE",
  "commonName": "<REGISTERED_COMPANY_NAME>",
  "keyType": "P-256",
  "type": "verifierSignRequest",
  "capabilities": {
    "openId4VpX509SanDns": false
  }
}

Once you have created the CSR and downloaded it as a .pem file, you can register it in the German EUDI Wallet Sandbox registrar. The registrar will return a signed certificate, which you can then import into Paradym.

1. Go to https://sandbox.eudi-wallet.org  and log in with your sandbox account.
2. Navigate to the “Overview”, click on “Certificates” in the “Your workspace” section, and then click on the ”+” button next to the “Access Certificates” section.
3. Fill in the form:

• Give the certificate a recognizable name (e.g. “Verifier Access Certificate - Paradym”).
• Click “Select CSR file” and upload the .pem file you downloaded from the CSR.

4. Click “Create Access Certificate” and then “Copy Certificate”.

Now you can import the certificate into Paradym. See the Importing an externally signed certificate guide for detailed instructions.

{
  "certificate": "-----BEGIN CERTIFICATE-----<CSR DATA>-----END CERTIFICATE-----"
}

Trusting the German PID Provider as the issuer

Trusted entities define which issuers you accept for a credential in a presentation template. Without one, credentials from any issuer are accepted.

The German EUDI Wallet publishes its trust lists for the sandbox  and production  environments. The PID is signed under the PID Providers List of Trusted Entities (LoTE). Other attestation types (EAAs) are signed under custom trust lists, not published on these websites.

Paradym maintains these trust lists as common trusted entities, and refreshes them daily, so there is nothing to set up: link one to your presentation template in the next step. You can inspect them on the Trusted Entities  page.

Use the entity of the environment you test against: the sandbox and production PIDs are signed under different trust lists, so a template that links one does not accept the PID of the other.

Creating the presentation template

A presentation template defines which credential and which attributes you request from the wallet. d-you holds the PID in both SD-JWT VC and mDoc format, so you can choose which format you want to verify. Each template:

• uses the X.509 certificate (P-256) authentication method (the access certificate you created),
• includes a registration certificate for the attributes it requests, and
• links the german-eudi-wallet-sandbox common trusted entity, so that only the PID issued by the German PID Provider is accepted.

Getting a registration certificate

d-you only accepts requests that come with a registration certificate for the attributes they request. The registration certificate is an EU Registration Certificate (ETSI TS 119 475) that the registrar issues for one use case, and Paradym sends it with every request created from the template. Request it before you create the template:

1. In the German EUDI Wallet Sandbox registrar , go to the “Overview” and click “Request attestations”.
2. Select the PID from the catalog.
3. Select the format you want to request: SD-JWT VC or mDoc.
4. Select the attributes you want to request. They must match the attributes of your presentation template. For the example templates below, select: Given Name, Family Name, Birth Date, Resident Street, Resident Postal Code, Resident City, Resident Country, Nationality, Issuing Authority and Issuing Country.
5. Click “Continue”.
6. Add a service name and a service description, for example “Example Bank” and “Online banking for private customers”.
7. Add a purpose, the reason you need this information, for example “We need to verify your identity to open your account”. The wallet shows it to the holder. You can add the service description and the purpose in multiple languages.
8. Click “Continue”, select the access certificate you created before, and click “Continue” again.
9. Click “Create registration certificate”, then “Open registration certificate”, and “Copy certificate”.

The registration certificate is a JWT starting with ey. You add it to the template below.

Creating the template

We recommend creating these templates through the API, as it lets you copy the payloads below exactly.

{
  "name": "Proof of Identity (SD-JWT VC)",
  "description": "This information is requested to verify your identity.",
  "verifier": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "eudi": {
    "registrationCertificate": "<REGISTRATION_CERTIFICATE>"
  },
  "credentials": [
    {
      "name": "Person Identification Data",
      "description": "PID from d-you",
      "format": "sd-jwt-vc",
      "type": "urn:eudi:pid:de:1",
      "trustedIssuers": [
        "german-eudi-wallet-sandbox"
      ],
      "attributes": {
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "birthdate": {
          "type": "date"
        },
        "address": {
          "type": "object",
          "properties": {
            "street_address": {
              "type": "string"
            },
            "postal_code": {
              "type": "string"
            },
            "locality": {
              "type": "string"
            },
            "country": {
              "type": "string"
            }
          }
        },
        "nationalities": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "issuing_authority": {
          "type": "string"
        },
        "issuing_country": {
          "type": "string"
        }
      }
    }
  ]
}

{
  "name": "Proof of Identity (mDoc)",
  "description": "This information is requested to verify your identity.",
  "verifier": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "eudi": {
    "registrationCertificate": "<REGISTRATION_CERTIFICATE>"
  },
  "credentials": [
    {
      "name": "Person Identification Data",
      "description": "PID from d-you",
      "format": "mdoc",
      "type": "eu.europa.ec.eudi.pid.1",
      "trustedIssuers": [
        "german-eudi-wallet-sandbox"
      ],
      "attributes": {
        "eu.europa.ec.eudi.pid.1": {
          "properties": {
            "given_name": {},
            "family_name": {},
            "birth_date": {},
            "resident_street": {},
            "resident_postal_code": {},
            "resident_city": {},
            "resident_country": {},
            "nationality": {},
            "issuing_authority": {},
            "issuing_country": {}
          }
        }
      }
    }
  ]
}

Paradym checks the registration certificate against your access certificate when you save the template. If you change the attributes of the template later, request a new registration certificate that covers them.

Requesting data from d-you

d-you credentials are presented over OpenID4VP, so you create an OpenID4VP verification request  from the presentation template you created above.

Make a POST request to https://api.paradym.id/v1/wallets/{walletId}/openid4vc/verification/request, passing the presentationTemplateId of the template. Response encryption is enabled by default, and we recommend keeping it enabled.

{
  "presentationTemplateId": "<PRESENTATION_TEMPLATE_ID>"
}

The response contains a few different URIs you can present to the holder. Which one you use depends on whether you want to route the holder through the Paradym invitation page or link straight into the wallet:

• authorizationRequestUri / authorizationRequestQrUri — these point to the Paradym invitation page, which renders a QR code and deeplinks into the wallet. Use these when you want the invitation page as an intermediary — for example for cross-device flows where the holder scans a QR. authorizationRequestQrUri returns that QR code directly as an image.
• authorizationRequestDeeplinkUri / authorizationRequestDeeplinkQrUri — these are the raw openid4vp:// deeplink, without the invitation page. Use these when you want to link directly into d-you from your own application or website. For example behind a “Continue in wallet” button on a same-device flow. authorizationRequestDeeplinkQrUri returns a QR code image encoding that deeplink.

{
  "id": "cmqv0gmum002b02s6vl2gol70",
  "authorizationRequestUri": "https://paradym.id/invitation?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%2FeyJyIjoxfQ&client_id=x509_hash%3A1mQ2eeNSaiqjN61UAcakxfKN7msnDb2-YN89fJywqxQ",
  "authorizationRequestQrUri": "https://paradym.id/invitation/eyJxIjoxfQ?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%2FeyJyIjoxfQ",
  "authorizationRequestDeeplinkUri": "openid4vp://?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%2FeyJyIjoxfQ&client_id=x509_hash%3A1mQ2eeNSaiqjN61UAcakxfKN7msnDb2-YN89fJywqxQ",
  "authorizationRequestDeeplinkQrUri": "https://paradym.id/invitation/eyJxIjoxLCJkIjoxfQ?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%2FeyJyIjoxfQ"
  // ... other parameters ...
}

See Verify credentials for the full verification flow, including the dashboard steps.

Handling the presentation response

Once the holder approves the request in d-you and the presentation is verified, the received credential data becomes available. The recommended way to receive it is through a webhook. Listen for the following events:

• openid4vc.verification.data — emitted when the verification succeeds, containing the disclosed attributes.
• openid4vc.verification.failed — emitted when the verification fails (for example, when the credential was not issued by a trusted entity, or a certificate in its chain is expired or revoked).

Alternatively, you can retrieve the verification session through the API by making a GET request to https://api.paradym.id/v1/wallets/{walletId}/openid4vc/verification/{openId4VcVerificationId} using the id from the verification request response. Note that verification data is only available through the API for a limited time, depending on your wallet’s “Verification data access” setting.

A completed SD-JWT VC PID verification looks like this. The disclosed attributes are under credentials[].presentedAttributes, and isValid confirms the issuer signature verified against the trusted entity. When verifying the mDoc PID, the attributes are instead keyed by the eu.europa.ec.eudi.pid.1 namespace and use the mDoc claim names.

{
  "id": "cmqv0gmum002b02s6vl2gol70",
  "createdAt": "2026-06-26T14:12:58.412Z",
  "updatedAt": "2026-06-26T14:13:10.738Z",
  "status": "verified",
  "error": null,
  "presentationTemplateId": "cmqv088ti001l02s6n72tlcxw",
  "credentials": [
    {
      "exchange": "openid4vc",
      "format": "sd-jwt-vc",
      "presentedAttributes": {
        "given_name": "Erika",
        "family_name": "Mustermann",
        "birthdate": "1964-08-12",
        "address": {
          "street_address": "Heidestraße 17",
          "postal_code": "51147",
          "locality": "Köln",
          "country": "DE"
        },
        "nationalities": ["DE"]
      },
      "raw": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6IjE...",
      "isValid": true,
      "issuer": {
        "commonName": "PID Issuer",
        "certificate": "-----BEGIN CERTIFICATE-----\nMIIDIzCCAsmgAwIBAgIUF…\n-----END CERTIFICATE-----"
      },
      "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:BhFl4IfPCkV9xRSOIz7RoVG2npQzktCcdramKdZMQ0c"
    }
  ],
  "expiresAt": "2026-06-26T14:27:58.408Z"
}

See Handling the verification response for the full details on webhooks, the API, and viewing verifications in the dashboard.

Creating an issuance certificate

To issue credentials into d-you, you sign your credentials with an X.509 issuer certificate. Create an issuer root certificate with a P-256 key. The certificates guide contains detailed guidance, but in short:

{
  "type": "issuerRoot",
  "keyType": "P-256",
  "countryName": "DE",
  "commonName": "Paradym",
  "issuerAlternativeNameUrl": "https://paradym.id"
}

Creating the credential template

A credential template defines the format, type and attributes of the credential you issue. Create one template per credential you want to issue, using the issuer certificate you created above as the issuer.

The template created here is an example, you can customize it according to your needs. See the Issue credentials guide for the full set of options (branding, validity, localization, and external integrations), but make sure to align it with the requirements from this guide so the credential is accepted by d-you.

{
  "name": "Membership Card",
  "description": "Membership attestation issued into d-you",
  "issuer": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "validUntil": {
    "start": "issuance",
    "future": {
      "months": 6
    }
  },
  "type": "MembershipCard",
  "attributes": {
    "membership_number": {
      "type": "string",
      "name": "Membership Number",
      "description": "Unique membership number",
      "required": true,
      "alwaysDisclosed": false
    },
    "full_name": {
      "type": "string",
      "name": "Full Name",
      "description": "Full name of the member",
      "required": true,
      "alwaysDisclosed": false
    }
  }
}

{
  "name": "Membership Card",
  "description": "Membership attestation issued into d-you",
  "issuer": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "validUntil": {
    "start": "issuance",
    "future": {
      "months": 6
    }
  },
  "type": "com.example.membership.1",
  "attributes": {
    "com.example.membership.1": {
      "properties": {
        "membership_number": {
          "type": "string",
          "name": "Membership Number",
          "description": "Unique membership number",
          "required": true
        },
        "full_name": {
          "type": "string",
          "name": "Full Name",
          "description": "Full name of the member",
          "required": true
        }
      }
    }
  }
}

Issuing a credential

d-you credentials are issued over OpenID4VC, so you create a credential offer  from the credential template you created above.

Make a POST request to https://api.paradym.id/v1/wallets/{walletId}/openid4vc/issuance/offer, passing the credentialTemplateId and the attributes values for this specific credential. The keys in attributes must match the keys you defined on the credential template. The example below is for the SD-JWT VC template. For the mDoc template, nest the attributes under their namespace: "attributes": { "com.example.membership.1": { "membership_number": "DE-0001234", "full_name": "Erika Mustermann" } }.

{
  "credentials": [
    {
      "credentialTemplateId": "<CREDENTIAL_TEMPLATE_ID>",
      "attributes": {
        "membership_number": "DE-0001234",
        "full_name": "Erika Mustermann"
      }
    }
  ]
}

If you configured the template with an external Attribute Provider, you can omit the attributes in the request, and Paradym will fetch them from the provider during issuance.

The response contains a few different URIs you can present to the holder. Which one you use depends on whether you want to route the holder through the Paradym invitation page or link straight into the wallet:

• offerUri / offerQrUri — these point to the Paradym invitation page, which renders a QR code and deeplinks into the wallet (or prompts to install it). offerQrUri returns that QR code directly as an image.
• offerDeeplinkUri / offerDeeplinkQrUri — these are the raw openid-credential-offer:// deeplink, without the invitation page. Use these when you want to link directly into d-you from your own application or website. For example behind a “Continue in wallet” button on a same-device flow. offerDeeplinkQrUri returns a QR code image encoding that deeplink.

{
  "id": "clv168twg000227kynam8v96w",
  "status": "offered",
  "offerUri": "https://paradym.id/invitation?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%2FeyJyIjoxfQ",
  "offerQrUri": "https://paradym.id/invitation/eyJxIjoxfQ?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%2FeyJyIjoxfQ",
  "offerDeeplinkUri": "openid-credential-offer://?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%2FeyJyIjoxfQ",
  "offerDeeplinkQrUri": "https://paradym.id/invitation/eyJxIjoxLCJkIjoxfQ?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%2FeyJyIjoxfQ",
  "credentials": [
    {
      "credentialTemplateId": "<CREDENTIAL_TEMPLATE_ID>",
      "status": "offered"
    }
  ]
}

You can use webhooks to get notified of changes in the credential issuance session, and view issuance sessions in the Activity  tab of the dashboard. See Issue credentials for the full issuance flow.