Skip to content
CredTrail Docs Official credential APIs for higher education
Platform site

OB3 reference

Wallet Import & Credential Exchange

Reference for wallet import flows using OpenID4VCI, public badge offers, and browser wallet actions.

Issuer discovery OB3 API Verification
  • OAuth 2.0 with PKCE
  • OpenAPI schema
  • Credential and profile routes
Reference Key routes
GET

/discovery

Discovery document for standards-aware clients.

GET

/credentials

Credential read access for the authenticated subject.

PUT

/profile

Profile synchronization for issuer-managed records.

Service base URL https://credtrail.org/ims/ob/v3p0
Primary protocol

OpenID4VCI

Pre-authorized code flow for wallet retrieval without requiring the learner to manage OAuth clients.

Browser option

Badge page action

Compatible browser wallet flows can begin directly from the public badge experience.

Starting point

/badges/:badgeIdentifier

Every exchange begins from the public badge URL and the signed credential record behind it.

Learner actions on badge pages

Section titled “Learner actions on badge pages”
Mobile path

Scan or deep-link into a wallet

Learners can scan the credential-offer QR code or open a mobile deep link using the openid-credential-offer:// scheme.

Desktop path

Use browser wallet actions or manual import

Compatible browsers can use wallet buttons directly, and JSON-LD downloads remain available for controlled manual import.

Endpoints

Section titled “Endpoints”
GETPublic

/.well-known/openid-credential-issuer

Issuer discovery document exposed for wallet and exchange clients.

POSTPublic

/credentials/offer

Creates a new credential offer from a public badge identifier.

GETPublic

/credentials/v1/offers/:badgeIdentifier

Returns the offer payload associated with the public badge record.

POSTPublic

/credentials/v1/token

Exchanges a pre-authorized code for a short-lived wallet access token.

POSTPublic

/credentials/v1/credentials

Returns the signed Open Badges 3.0 credential response body to the wallet client.

GETPublic

/badges/:badgeIdentifier/jsonld

Provides human-readable alias access to the JSON-LD credential for supported manual import flows.

Security model

Section titled “Security model”
Security guardrails

Short-lived, single-use exchange primitives keep learner delivery constrained.

  • Pre-authorized codes are single-use.
  • Pre-authorized codes expire in 10 minutes.
  • OID4VCI access tokens expire in 10 minutes.
  • Credential responses are Cache-Control: no-store.

Exchange sequence

Section titled “Exchange sequence”

  1. Create an offer. Generate the credential offer from a public badge identifier that resolves to an issued record.

  2. Exchange the pre-authorized code. Wallet clients redeem the code for a short-lived access token.

  3. Fetch the credential payload. The wallet requests the credential in ldp_vc format and stores the DataIntegrityProof-signed JSON-LD artifact locally.

End-to-end example

Section titled “End-to-end example”
Terminal window
curl -sS https://credtrail.org/credentials/offer \
  -H "content-type: application/json" \
  -d '{"badgeIdentifier":"40a6dc92-85ec-4cb0-8a50-afb2ae700e22"}' | jq
Section titled “Related docs”
Institution automationSee how institutional systems create and revoke the credential records that wallets later retrieve.Public verification and downloadsReview the shareable badge URLs and verification payloads that sit alongside wallet actions.Open Badges 3.0 APIReview discovery, OAuth, credential, and profile endpoints that back the same record system.