Creates a wallet provider bound to a specific IT-Wallet specification version.
SDK configuration.
Specification version used for wallet attestation routing.
Creates a wallet unit attestation.
The key attestation is a signed token that describes the attested keys, their storage characteristics, user authentication level, and status, and can include certification and a trust chain as needed.
The options used to construct and sign the key attestation JWT.
A promise that resolves to the signed key attestation JWT.
Creates a wallet attestation JWT according to the configured Italian Wallet specification version.
Version Differences:
trust_chain in header (federation method); no status claimx5c in header, optional trust_chain; supports optional nbf and status claimsx5c in header, optional trust_chain; wallet_link and wallet_name are
required; no status claim; sets sub to the DPoP JWK thumbprintThe necessary parameters to build the attestation.
A promise that resolves to the signed wallet attestation JWT as a string.
When the provided options do not match the configured IT-Wallet
specification version, or when v1.4 options are missing walletLink or walletName.
When wallet attestation JWT creation fails unexpectedly,
including signing errors from the configured signJwt callback.
v1.0 - Basic wallet attestation with trust chain
const jwt = await provider.createItWalletAttestationJwt({
callbacks: { hash: myHashCallback, signJwt: mySignJwtCallback },
dpopJwkPublic: myJwk,
issuer: "https://wallet-provider.example.com",
signer: {
alg: "ES256",
kid: "provider-key-id",
trustChain: ["trust-anchor-jwt", "intermediate-jwt"]
}
});
v1.3 - Wallet attestation with x5c and optional fields
const jwt = await provider.createItWalletAttestationJwt({
callbacks: { hash: myHashCallback, signJwt: mySignJwtCallback },
dpopJwkPublic: myJwk,
issuer: "https://wallet-provider.example.com",
signer: {
alg: "ES256",
kid: "provider-key-id",
x5c: ["cert1-base64", "cert2-base64"],
trustChain: ["trust-anchor-jwt"] // Optional in v1.3
},
nbf: new Date('2025-01-01'), // Optional
status: { status_list: { idx: 2, uri: "https://status.example.com" } } // Optional
});
v1.4 - Wallet attestation with required wallet_link and wallet_name
const jwt = await provider.createItWalletAttestationJwt({
callbacks: { hash: myHashCallback, signJwt: mySignJwtCallback },
dpopJwkPublic: myJwk,
issuer: "https://wallet-provider.example.com",
signer: {
alg: "ES256",
kid: "provider-key-id",
method: "x5c",
x5c: ["cert1-base64", "cert2-base64"],
trustChain: ["trust-anchor-jwt"] // Optional
},
walletLink: "https://wallet.example.com", // Required
walletName: "My Wallet", // Required
nbf: new Date('2025-01-01') // Optional
});
WalletProvider An implementation of a wallet provider for the OpenID4VCI protocol, tailored for the Italian ecosystem. It handles the creation of wallet attestations required during the credential issuance flow.