# @kaytrust/openid4vci

## OpenID4VCI Flow


See [OpenID for Verifiable Credential Issuance - draft 15](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html)

This specification defines an OAuth-protected API for the issuance of Verifiable Credentials. Credentials can be of any format, including, but not limited to, IETF SD-JWT VC, ISO mDL, and W3C VCDM.

Verifiable Credentials are very similar to identity assertions, like ID Tokens in OpenID Connect, in that they allow a Credential Issuer to assert End-User claims. A Verifiable Credential follows a pre-defined schema (the Credential type) and MAY be bound to a certain holder, e.g., through Cryptographic Holder Binding. Verifiable Credentials can be securely presented for the End-User to the RP, without involvement of the Credential Issuer.

Access to this API is authorized using OAuth 2.0, i.e., the Wallet uses OAuth 2.0 to obtain authorization to receive Verifiable Credentials. This way the issuance process can benefit from the proven security, simplicity, and flexibility of OAuth 2.0 and existing OAuth 2.0 deployments and OpenID Connect OPs can be extended to become Credential Issuers.

![OpenID4VCI Flow](./docs/images/openid4vci-flow.png)

IMPORTANT! THIS LIBRARY HAS CODE RELATED TO SIX STEP

## SIOPv2

SIOPv2, or Self-Issued OpenID Provider v2, is an extension of the OpenID Connect protocol designed to empower users to act as their own OpenID Providers (OPs). This allows individuals to authenticate directly with relying parties (RPs), such as websites or applications, without dependingS on third-party identity providers.

```ts

import { siopFlow } from '@kaytrust/openid4vci'

const privateKey = "..."

const issuer = "did:ethr:0x..." // your did:ethr
const credentials_to_share_in_jwt_format = ["...", "..."]

const uri_offering = "openid://?state=e0520dc4-b57a-47c5-8ebf-ed95175561c8&redirect_uri=https%3A%2F%2Ffrutas-back.demo.kaytrust.id%2Foauth2%2Fcb%2FvpToken&response_mode=query&response_type=vp_token&client_id=https%3A%2F%2Ffrutas-back.demo.kaytrust.id%2Foauth&scope=openid" // A URI that contains info about how handle the siop flow.

const result = await siopFlow(uri_offering, issuer, {privateKey}, credentials_to_share_in_jwt_format)

/**
 * Results
 * 
 * {
 *  url?: string, // redirect uri
 *  modeAs: UrlModeAs, // "response" | "request"
 *  response_mode: ResponseMode // "direct_post" | "query" | "fragment"
 * }
 * 
 **/
```

### Verify vpToken

```ts
import { verifyJWTFromVp } from '@kaytrust/openid4vci'

const vpToken = "<JWT>" // jwt token

const RPC_AMOY = "<RPC_URL>";
const AMOY_CHAIN_ID = 80002;

const audience = "https://frutas-back.demo.kaytrust.id/oauth"

const verified_result = await verifyJWTFromVp(vpToken, {registry: '0xBC56d0883ef228b2B16420E9002Ece0A46c893F8', rpcUrl: RPC_AMOY, chainId: AMOY_CHAIN_ID}, audience)
```