README

A framework-agnostic PHP SDK for building server-side EUDI Wallet verifier integrations. It provides OpenID for Verifiable Presentations (OpenID4VP) orchestration, DCQL requests, HAIP 1.0 request and encrypted response handling, SD-JWT VC verification, trust resolution, QR rendering, and test utilities.

This is an independent, community-developed project and is not an official European Commission or EUDI Wallet reference implementation.

This project is under active development. Review the implementation and your applicable regulatory, security, and interoperability requirements before using it in production.

Requirements

PHP 8.2 or later
OpenSSL, JSON, and zlib PHP extensions
Composer 2

Installation

After the package has been published on Packagist:

composer require malikzohaib/openid4vp-eudi-verifier

Before it is on Packagist, another project can install it directly from GitHub:

{
  "repositories": [
    {
      "type": "vcs",
      "url": "https://github.com/MalikZohaib/openid4vp-eudi-verifier.git"
    }
  ],
  "require": {
    "malikzohaib/openid4vp-eudi-verifier": "dev-main"
  }
}

Replace the example GitHub URL with the actual repository URL. For production projects, install a tagged release such as ^1.0 instead of dev-main.

Composer loads all SDK namespaces automatically through vendor/autoload.php:

<?php

require __DIR__ . '/vendor/autoload.php';

use Eudi\VerifierCore\Dcql\CredentialQuery;
use Eudi\VerifierCore\Dcql\DcqlQuery;
use Eudi\VerifierCore\Domain\PresentationRequest;

$request = new PresentationRequest(
    dcql: new DcqlQuery([
        CredentialQuery::sdJwt(
            id: 'identity',
            vct: 'urn:example:identity-credential',
            claimNames: ['given_name', 'family_name'],
        ),
    ]),
    purpose: 'Verify your identity',
);

Pass the request to a configured Eudi\VerifierCore\Application\VerifierService. A host framework or extension must supply implementations for session persistence and request-object signing; the SDK deliberately keeps these integration concerns behind interfaces.

Packages and namespaces

Namespace	Purpose
`Eudi\VerifierCore\`	OpenID4VP flow, DCQL, domain objects, contracts, and HAIP helpers
`Eudi\CredentialSdJwt\`	SD-JWT VC parsing, disclosures, key binding, status, and X.509 trust validation
`Eudi\CredentialMdoc\`	Extension point for ISO mdoc verification
`Eudi\Trust\`	Trust resolver contracts and a static trust store
`Eudi\Http\`	`direct_post` form parsing helpers
`Eudi\QrCode\`	QR-code rendering adapter
`Eudi\Testing\`	In-memory/file stores, fake wallet, issuer, keys, and clocks for development

The component-level composer.json files are retained so components can later be published independently. Installing malikzohaib/openid4vp-eudi-verifier installs and autoloads all components as one package.

Integration flow

Create a VerifierConfig for your public verifier URL, client identifier, wallet authorization endpoint, response mode, and profile.
Implement SessionStoreInterface using durable, concurrency-safe storage.
Implement RequestObjectSignerInterface, normally with a production certificate-backed signer.
Register the credential format handlers you accept in CredentialHandlerRegistry.
Call VerifierService::start() with a PresentationRequest.
Expose the returned request URI and redirect or display the authorization URI as a QR code.
Pass the wallet's form body to VerifierService::handleDirectPost().
Read verified credentials only from the completed session's verification result.

For the exact HAIP 1.0 redirect call path and security behavior, see HAIP-1.0.md.

Security notes

Never use the demo HMAC signer, fake wallet, demo issuer, or in-memory session store in production.
Keep response-decryption private keys server-side and isolate them per transaction.
Use an atomic, single-use session store to prevent replay and concurrent consumption.
Configure issuer trust anchors explicitly and validate certificates according to your trust framework.
Credential status is fail-closed unless a status-list token fetcher is configured.
Terminate TLS only in trusted infrastructure and do not log credentials, presentations, private keys, or authorization responses.

Please report vulnerabilities according to SECURITY.md, not through a public issue.

Development

composer install
composer validate --strict
find packages -name '*.php' -print0 | xargs -0 -n1 php -l

See CONTRIBUTING.md for contribution and release guidance.

Publishing

Move this directory into its own public GitHub repository (or publish it with a subtree split).
Confirm that homepage, support, and README URLs match the public repository.
Push the default branch and confirm the GitHub Actions build passes.
Register the repository at Packagist and enable its GitHub hook.
Create a SemVer tag such as v1.0.0; do not add a version field to composer.json.

Consumers can then install a stable line with composer require malikzohaib/openid4vp-eudi-verifier:^1.0.

License

Released under the MIT License.

malikzohaib / openid4vp-eudi-verifier

Package info

Security

Statistics