🇩🇪 German EUDI Wallet

Getting an access certificate from the German EUDI Wallet Sandbox

To request credentials from the German EUDI Wallet, you authenticate your presentation requests with an X.509 verifier certificate. The German EUDI Wallet currently only requires an access certificate (identifying the organization) to authenticate your presentation requests, and does not require a registration certificate yet.

First we need to create a Certificate Signing Request (CSR) with a P-256 key for the access certificate. The Certificate Signing Requests guide contains detailed guidance.

We recommend creating the Certificate Signing Request through the dashboard as it allows to easily copy the public key in the format the German EUDI Wallet Sandbox registrar requires. You can also create the CSR through the API, but will have to to manually transform the CSR to a SPKI (Subject Public Key Info) in PEM format.

{
  "countryName": "DE",
  "commonName": "<REGISTERED_COMPANY_NAME>",
  "keyType": "P-256",
  "type": "verifierSignRequest"
}

printf '%b' "-----BEGIN CERTIFICATE REQUEST-----<CSR DATA>-----END CERTIFICATE REQUEST-----" | openssl req -pubkey -noout

Once you have created the CSR and obtained the public key, you can register it in the German EUDI Wallet Sandbox registrar. The registrar will return a signed certificate, which you can then import into Paradym.

1. Go to https://sandbox.eudi-wallet.org  and log in with your sandbox account.
2. Navigate to the “Dashboard”, click on your registered Relying Party, and then click on the ”+” button next to the “Access Certificates” section.
3. Fill in the form:

• DNS Entries: agent.paradym.id
• Public Key: Paste the SPKI PEM you extracted from the CSR.

4. Click “Create Access Certificate” and then “Copy Certificate”.

Now you can import the certificate into Paradym. See the Importing an externally signed certificate guide for detailed instructions.

{
  "certificate": "-----BEGIN CERTIFICATE-----<CSR DATA>-----END CERTIFICATE-----"
}

Registering the German PID Provider as a trusted entity

Trusted Entities in Paradym enable you to define the issuers you trust. Trusted entities can be linked to a specific credential that is requested in a presentation template, and limit who can issue a specific credential. This ensures only the authorized issuers of a credential (in this case the German PID Provider) are trusted during credential verification.

The German EUDI Wallet Sandbox has a website where it publishes it’s trust lists . The PID is signed under the EUDI Pid Providers List of Trusted Entities (LoTE). Other attestation types (EAAs) are signed under custom trust lists, not published on this website.

To configure Paradym to only accept the PID issued by the German Sandbox, you register the LoTE on a trusted entity and link it to your presentation template.

Once the EU publishes a publicly available List of Trusted Entities (LoTE) you will be able to select this list in Paradym. Until then you will have to register the LoTE from the German Sandbox manually.

Create a single trusted entity for the German EUDI Wallet Sandbox. Note the id of the created trusted entity, as you’ll need it to link it to your presentation template below.

{
  "name": "German EUDI Wallet Sandbox",
  "etsiLotes": [
    {
      "name": "PID Providers",
      "url": "https://bmi.usercontent.opencode.de/eudi-wallet/test-trust-lists/pid-provider.jwt",
      "certificate": "-----BEGIN CERTIFICATE-----\nMIICDDCCAbGgAwIBAgIUNY57W5ZMQd54F96UP0jRWWnnHCkwCgYIKoZIzj0EAwIw\nWzELMAkGA1UEBhMCREUxDzANBgNVBAgMBkJlcmxpbjEPMA0GA1UEBwwGQmVybGlu\nMRQwEgYDVQQKDAtUcnVzdCBMaXN0czEUMBIGA1UEAwwLTG9URSBTaWduZXIwHhcN\nMjYwMzIzMTA1NzE0WhcNMzYwMzIwMTA1NzE0WjBbMQswCQYDVQQGEwJERTEPMA0G\nA1UECAwGQmVybGluMQ8wDQYDVQQHDAZCZXJsaW4xFDASBgNVBAoMC1RydXN0IExp\nc3RzMRQwEgYDVQQDDAtMb1RFIFNpZ25lcjBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABJI2t4NHAHvyUmWjFWWq1wRC7wWhoYsdKb//uMpdiAVeBTFlOaaC0DAppVcY\n94oWO2gRx4Pb5Ae6izprfTFhkSmjUzBRMB0GA1UdDgQWBBRB+dSpSYViEtAu6hNx\noHPSbfcZyDAfBgNVHSMEGDAWgBRB+dSpSYViEtAu6hNxoHPSbfcZyDAPBgNVHRMB\nAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDNdv3YAVQqJvxkNHyar2TAfAgJ\nkc83Nwni+jFyvjAjFwIhAOxJw3mCf1Mqq1lO41et3iViCUjdCbpdABXIi3JqzTN8\n-----END CERTIFICATE-----"
    }
  ]
}

Creating the presentation template

A presentation template defines which credential and which attributes you request from the wallet. The German EUDI Wallet holds the PID in both SD-JWT VC and mDoc format, so you can choose which format you want to verify. Each template:

• uses the X.509 certificate (P-256) authentication method (the access certificate you created), and
• links the trusted entity you created so that only the PID issued by the German PID Provider is accepted.

We recommend creating these templates through the API, as it lets you copy the payloads below exactly.

{
  "name": "Proof of Identity (SD-JWT VC)",
  "description": "This information is requested to verify your identity.",
  "verifier": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "credentials": [
    {
      "name": "Person Identification Data",
      "description": "PID from the German EUDI Wallet",
      "format": "sd-jwt-vc",
      "type": "urn:eudi:pid:de:1",
      "trustedIssuers": [
        "<TRUSTED_ENTITY_ID>"
      ],
      "attributes": {
        "given_name": {
          "type": "string"
        },
        "family_name": {
          "type": "string"
        },
        "birthdate": {
          "type": "date"
        },
        "address": {
          "type": "object",
          "properties": {
            "street_address": {
              "type": "string"
            },
            "postal_code": {
              "type": "string"
            },
            "locality": {
              "type": "string"
            },
            "country": {
              "type": "string"
            }
          }
        },
        "nationalities": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "issuing_authority": {
          "type": "string"
        },
        "issuing_country": {
          "type": "string"
        }
      }
    }
  ]
}

{
  "name": "Proof of Identity (mDoc)",
  "description": "This information is requested to verify your identity.",
  "verifier": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "credentials": [
    {
      "name": "Person Identification Data",
      "description": "PID from the German EUDI Wallet",
      "format": "mdoc",
      "type": "eu.europa.ec.eudi.pid.1",
      "trustedIssuers": [
        "<TRUSTED_ENTITY_ID>"
      ],
      "attributes": {
        "eu.europa.ec.eudi.pid.1": {
          "properties": {
            "given_name": {},
            "family_name": {},
            "birth_date": {},
            "resident_street": {},
            "resident_postal_code": {},
            "resident_city": {},
            "resident_country": {},
            "nationality": {},
            "issuing_authority": {},
            "issuing_country": {}
          }
        }
      }
    }
  ]
}

Requesting data from the German EUDI Wallet

German EUDI Wallet credentials are presented over OpenID4VP, so you create an OpenID4VP verification request  from the presentation template you created above.

Make a POST request to https://api.paradym.id/v1/projects/{projectId}/openid4vc/verification/request, passing the presentationTemplateId of the template. Response encryption is enabled by default, and we recommend keeping it enabled.

{
  "presentationTemplateId": "<PRESENTATION_TEMPLATE_ID>"
}

The response contains a few different URIs you can present to the holder. Which one you use depends on whether you want to route the holder through the Paradym invitation page or link straight into the wallet:

• authorizationRequestUri / authorizationRequestQrUri — these point to the Paradym invitation page, which renders a QR code and deeplinks into the wallet. Use these when you want the invitation page as an intermediary — for example for cross-device flows where the holder scans a QR. authorizationRequestQrUri returns that QR code directly as an image.
• authorizationRequestDeeplinkUri / authorizationRequestDeeplinkQrUri — these are the raw openid4vp:// deeplink, without the invitation page. Use these when you want to link directly into the German EUDI Wallet from your own application or website. For example behind a “Continue in wallet” button on a same-device flow. authorizationRequestDeeplinkQrUri returns a QR code image encoding that deeplink.

{
  "id": "cmqv0gmum002b02s6vl2gol70",
  "authorizationRequestUri": "https://paradym.id/invitation?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%3Fraw%3Dtrue&client_id=x509_hash%3A1mQ2eeNSaiqjN61UAcakxfKN7msnDb2-YN89fJywqxQ",
  "authorizationRequestQrUri": "https://paradym.id/invitation?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%3Fraw%3Dtrue&qr=true",
  "authorizationRequestDeeplinkUri": "openid4vp://?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%3Fraw%3Dtrue&client_id=x509_hash%3A1mQ2eeNSaiqjN61UAcakxfKN7msnDb2-YN89fJywqxQ",
  "authorizationRequestDeeplinkQrUri": "https://paradym.id/invitation?request_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F6abba887-8ed8-40a7-8e3f-339cc29f6cab%2Fauthorization-requests%2Fd9530d1e-d52f-488f-bfec-016011704e3b%3Fraw%3Dtrue&qr=true&deeplink=true"
  // ... other parameters ...
}

See Verify credentials for the full verification flow, including the dashboard steps.

Handling the presentation response

Once the holder approves the request in the German EUDI Wallet and the presentation is verified, the received credential data becomes available. The recommended way to receive it is through a webhook. Listen for the following events:

• openid4vc.verification.data — emitted when the verification succeeds, containing the disclosed attributes.
• openid4vc.verification.failed — emitted when the verification fails (for example, when the credential was not issued by a trusted entity, or a certificate in its chain is expired or revoked).

Alternatively, you can retrieve the verification session through the API by making a GET request to https://api.paradym.id/v1/projects/{projectId}/openid4vc/verification/{openId4VcVerificationId} using the id from the verification request response. Note that verification data is only available through the API for a limited time, depending on your project’s “Verification data access” setting.

A completed SD-JWT VC PID verification looks like this. The disclosed attributes are under credentials[].presentedAttributes, and isValid confirms the issuer signature verified against the trusted entity. When verifying the mDoc PID, the attributes are instead keyed by the eu.europa.ec.eudi.pid.1 namespace and use the mDoc claim names.

{
  "id": "cmqv0gmum002b02s6vl2gol70",
  "createdAt": "2026-06-26T14:12:58.412Z",
  "updatedAt": "2026-06-26T14:13:10.738Z",
  "status": "verified",
  "error": null,
  "presentationTemplateId": "cmqv088ti001l02s6n72tlcxw",
  "credentials": [
    {
      "exchange": "openid4vc",
      "format": "sd-jwt-vc",
      "presentedAttributes": {
        "given_name": "Erika",
        "family_name": "Mustermann",
        "birthdate": "1964-08-12",
        "address": {
          "street_address": "Heidestraße 17",
          "postal_code": "51147",
          "locality": "Köln",
          "country": "DE"
        },
        "nationalities": ["DE"]
      },
      "raw": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRjK3NkLWp3dCIsImtpZCI6IjE...",
      "isValid": true,
      "issuer": {
        "commonName": "PID Issuer",
        "certificate": "-----BEGIN CERTIFICATE-----\nMIIDIzCCAsmgAwIBAgIUF…\n-----END CERTIFICATE-----"
      },
      "holder": "urn:ietf:params:oauth:jwk-thumbprint:sha-256:BhFl4IfPCkV9xRSOIz7RoVG2npQzktCcdramKdZMQ0c"
    }
  ],
  "expiresAt": "2026-06-26T14:27:58.408Z"
}

See Handling the verification response for the full details on webhooks, the API, and viewing verifications in the dashboard.

Creating an issuance certificate

To issue credentials into the German EUDI Wallet, you sign your credentials with an X.509 issuer certificate. Create an issuer root certificate with a P-256 key. The certificates guide contains detailed guidance, but in short:

{
  "type": "issuerRoot",
  "keyType": "P-256",
  "countryName": "DE",
  "commonName": "Paradym",
  "issuerAlternativeNameUrl": "https://paradym.id"
}

Creating the credential template

A credential template defines the format, type and attributes of the credential you issue. Create one template per credential you want to issue, using the issuer certificate you created above as the issuer.

The template created here is an example, you can customize it according to your needs. See the Issue credentials guide for the full set of options (branding, validity, localization, and external integrations), but make sure to align it with the requirements from this guide so the credential is accepted by the German EUDI Wallet.

{
  "name": "Membership Card",
  "description": "Membership attestation issued into the German EUDI Wallet",
  "issuer": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "validUntil": {
    "start": "issuance",
    "future": {
      "years": 1
    }
  },
  "type": "MembershipCard",
  "attributes": {
    "membership_number": {
      "type": "string",
      "name": "Membership Number",
      "description": "Unique membership number",
      "required": true,
      "alwaysDisclosed": false
    },
    "full_name": {
      "type": "string",
      "name": "Full Name",
      "description": "Full name of the member",
      "required": true,
      "alwaysDisclosed": false
    }
  }
}

{
  "name": "Membership Card",
  "description": "Membership attestation issued into the German EUDI Wallet",
  "issuer": {
    "signer": "certificate",
    "keyType": "P-256"
  },
  "validUntil": {
    "start": "issuance",
    "future": {
      "years": 1
    }
  },
  "type": "com.example.membership.1",
  "attributes": {
    "com.example.membership.1": {
      "membership_number": {
        "type": "string",
        "name": "Membership Number",
        "description": "Unique membership number",
        "required": true,
        "alwaysDisclosed": false
      },
      "full_name": {
        "type": "string",
        "name": "Full Name",
        "description": "Full name of the member",
        "required": true,
        "alwaysDisclosed": false
      }
    }
  }
}

Issuing a credential

German EUDI Wallet credentials are issued over OpenID4VC, so you create a credential offer  from the credential template you created above.

Make a POST request to https://api.paradym.id/v1/projects/{projectId}/openid4vc/issuance/offer, passing the credentialTemplateId and the attributes values for this specific credential. The keys in attributes must match the keys you defined on the credential template.

{
  "credentials": [
    {
      "credentialTemplateId": "<CREDENTIAL_TEMPLATE_ID>",
      "attributes": {
        "membership_number": "DE-0001234",
        "full_name": "Erika Mustermann"
      }
    }
  ]
}

If you configured the template with an external Attribute Provider, you can omit the attributes in the request, and Paradym will fetch them from the provider during issuance.

The response contains a few different URIs you can present to the holder. Which one you use depends on whether you want to route the holder through the Paradym invitation page or link straight into the wallet:

• offerUri / offerQrUri — these point to the Paradym invitation page, which renders a QR code and deeplinks into the wallet (or prompts to install it). offerQrUri returns that QR code directly as an image.
• offerDeeplinkUri / offerDeeplinkQrUri — these are the raw openid-credential-offer:// deeplink, without the invitation page. Use these when you want to link directly into the German EUDI Wallet from your own application or website. For example behind a “Continue in wallet” button on a same-device flow. offerDeeplinkQrUri returns a QR code image encoding that deeplink.

{
  "id": "clv168twg000227kynam8v96w",
  "status": "offered",
  "offerUri": "https://paradym.id/invitation?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%3Fraw%3Dtrue",
  "offerQrUri": "https://paradym.id/invitation?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%3Fraw%3Dtrue&qr=true",
  "offerDeeplinkUri": "openid-credential-offer://?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%3Fraw%3Dtrue",
  "offerDeeplinkQrUri": "https://paradym.id/invitation?credential_offer_uri=https%3A%2F%2Fparadym.id%2Finvitation%2F7d7628cc-8221-4783-a5ce-f0f2b335361f%2Foffers%2Fe5fade58-5145-4b9b-a3bd-7428fbc995b2%3Fraw%3Dtrue&qr=true&deeplink=true",
  "credentials": [
    {
      "credentialTemplateId": "<CREDENTIAL_TEMPLATE_ID>",
      "status": "offered"
    }
  ]
}

You can use webhooks to get notified of changes in the credential issuance session, and view issuance sessions in the Activity  tab of the dashboard. See Issue credentials for the full issuance flow.