PID & attestations
OpenID4VCI pre-authorized flow with PAR + WIA client_assertion. All four credential formats: mDoc (ISO 18013-5), SD-JWT VC, JWT VC, BBS+ unlinkable. Schema-driven catalogue.
Built for eIDAS 2.0 — the EU Digital Identity Wallet
European Digital Identity, production-ready infrastructure.
Issue PID and EAA credentials, accept verified presentations from any EUDI wallet, manage trust and revocation — all from a single, open backend you can deploy and integrate in days.
eIDAS 2.0
ISO 18013-5 / -7
OpenID4VCI / OpenID4VP
OpenID conformance-tested
SD-JWT VC
RFC 9596
iOS + Android
Business cases
Three sectors where the EUDI Wallet becomes mandatory.
Under Regulation (EU) 2024/1183 + the DSA, accepting the European Wallet becomes a legal requirement across several sectors from 2026. Click any case for the full flow, the European Commission's official wording, and the mandatory dates.
Financial services
KYC, account opening, credit applications — no ID-card photocopies.
Read case →
Public services & hospitality
Hospital, hotel, event — offline presentation, no account, no booking.
Read case →
Online age verification
18+ content, alcohol delivery, gambling — Zero-Knowledge Proof, no PII.
Read case →
Events & festivals
Ticket in wallet, gate scan in 2 seconds, in-event cashless without a wristband.
Read case →
Fitness & memberships
Gym access — no plastic card, no account, no queue. Wallet pass + reception tap.
Read case →
Digital content & streaming
TV subscription verified — no e-mail, no card, no new account. Just scan the on-screen QR.
Read case →One backend. Every flow your application will need.
Citizen identity, attribute attestations, presentation, trust management — modular, not a closed product. You ship features, not protocol code.
Verifier & OID4VP
Online cross-device QR (ISO 18013-7) or in-person ISO 18013-5 BLE proximity. DCQL processor, transaction_data binding, audit cross-flow correlation. SIOP v2 bridge for legacy OIDC apps. Validated against the OpenID Foundation's OID4VP conformance suite.
Wallet-to-Wallet
One wallet requests attributes from another over the same presentation interface. Full OpenID4VP / EUDI § 6.6.4 implementation — consent, device-auth, intermediary chains.
Strong Customer Authentication
End-to-end SCA flow for electronic payments per EUDI § 2.6.4 — initiate / respond / settle-from-presentation / receipt. Strict-mode enforced, transaction_data signed.
PID-gated network access
WiFi, mobility, telecom — RP requests scope=network_access, server applies policy on PID claims, the wallet auto-connects via a signed network config QR.
Trust & revocation
Trust anchor + RP + Issuer registry with separated registration / access certs. Bitstring StatusList per RFC 9596. Offline-friendly wallet revocation check.
Pseudonyms & ZKP
All four EUDI § 2.5 pseudonym use cases — anonymous auth, attribute registration, rate-limited participation, linkable cross-RP. WebAuthn ES256, ZKP scheme registry, BBS+ derived proofs.
Native iOS + Android wallet
A native holder wallet on iOS and Android, plus a field validator — built end-to-end at ForTrust. White-label ready, commercial licence per agreement. Hardware-backed holder binding via AndroidKeyStore (Android) and the Secure Enclave (iOS).
Data-subject rights
Right to erasure, right to portability, DPA complaints — all wired as services with operator workflows. Tamper-evident audit chain on both server and validator.
Two apps. One stack.
The holder wallet runs native on iOS and Android; the field validator on Android. Both are built end-to-end inside ForTrust — no SDK fork, no third-party black boxes. Available commercially: hosted, dedicated deployment, or white-label, as needed.
Holder app · iOS + Android
ForTrust Wallet
The user's EUDI wallet. Enrols PID and EAA credentials, signs presentations on the device, talks to verifiers over BLE proximity or cross-device QR.
- NFC enrollment from Romanian eID and ICAO 9303 passports — PACE / BAC, Active Authentication, Chip Authentication, SOD signature verification.
- Hardware-backed holder binding — credential keys generated and used inside AndroidKeyStore (TEE / StrongBox) on Android and the Secure Enclave on iOS; attested via Play Integrity and App Attest respectively.
- Selective disclosure on every presentation — wallet UI shows the user exactly what each RP requested before consent.
- Multi-format — mso_mdoc (ISO 18013-5), SD-JWT VC, JWT VC, BBS+ unlinkable presentations.
- Proximity + cross-device + W2W presentation flows, all standards-compliant.
- Per-RP pseudonyms with quotas; WebAuthn local authentication hooks.
- Offline revocation check via cached StatusList — wallet refuses suspended credentials at the UI layer, before any handshake.
Verifier app
ForTrust Validator
The relying-party reader. Used at counters, kiosks, in the field — anywhere a verifier needs to read a wallet's PID or attestation and decide on the spot.
- BLE proximity verification per ISO 18013-5, with full ReaderAuth / DeviceResponse / SessionTranscript handling.
- STRICT_KEYSTORE RP key — the validator's signing key is non-extractable, lives in AndroidKeyStore TEE; PKCS#10 CSR enrollment + automatic 1-year cert renewal.
- Tamper-evident audit log — every verification recorded into an HMAC-chained ledger keyed by an AndroidKeyStore-resident HMAC key. Edits to the DB break the chain on next verify.
- Operator-grade trust UI — trust anchor admin, RP cert lifecycle dashboard, expiry warnings, daily auto-renewal worker.
- Offline operation — verifies presentations against a cached trust snapshot; sync runs daily and on demand.
- GDPR retention worker — verification records auto-pruned per the configured retention policy.
Conformance-tested — on both sides of the wire.
The ForTrust wallet and issuer are validated against the OpenID Foundation's official OID4VP 1.0 Final and OID4VCI conformance suites, under the HAIP profile (the EU High-Assurance Interoperability Profile), with ISO mDL credentials. Coverage goes beyond the happy path to DCQL query handling (selective disclosure, optional credential sets) and negative security cases (invalid nonce, missing or malformed key-binding proofs). Verified on iOS and Android.
Engineered from scratch. Not a fork of an SDK.
Every protocol layer in the stack — mDoc CBOR, COSE_Sign1,
OpenID4VCI, OpenID4VP, DCQL, status-list revocation, trust
verification, BBS+ — is implemented in-house. No
eudi-lib-*, no third-party EUDI SDK in the dependency
tree. Three things that buys you:
01
Source ownership
Every byte of the implementation is auditable in your own security review. No black-box library that your CISO has to accept on trust.
02
Independent release cadence
Ship features, patch CVEs, evolve trust policy on your own schedule. Not coupled to upstream consortium release windows or to deprecation cycles you didn't choose.
03
Standards-only interop
Wallet, server, and validator talk to each other strictly through published RFCs and EUDI protocols. Each piece is replaceable; no vendor lock-in even between our own components.
32/32
EUDI specification items delivered
0
EUDI SDK dependencies
3
Apps in the stack (server + wallet + validator)
RO
Built and supported in Romania
The "fully compliant" claim refers to functional code coverage of the EU Digital Identity Wallet specification. Production deployment for real citizens still requires the operational artefacts every EUDI Wallet Provider needs: ICAO PKD subscription, accredited certification, EUDIW Reference Verifier interop runs, and ANC accreditation as a Wallet Provider. We support our customers through that path.
Integrate in three steps.
Your app keeps speaking standard OpenID Connect. The user's wallet handles the cryptography. You receive verified claims as JSON.
Initiate the session
GET /oidc/authorize/
with client_id, redirect_uri, scope. Receive a session id and a
wallet URI to render as a QR.
scope=openid+eudi_pid
The user presents
The wallet scans the QR (or uses BLE in proximity flows), the user reviews the request and consents. Verification is performed server-side under your trust policy.
mdoc-openid4vp://…
Receive the claims
Poll /oidc/userinfo/<sid>/
— 202 while pending, 200 with verified JSON when done. No COSE,
no certificate plumbing on your side.
{"given_name": "…", "age_over_18": true}
Specifications.
Implementation aligned with the European framework and the underlying RFCs. No fabricated certifications — every standard listed here is one we actually implement and test against.
Architecture profile
eIDAS 2.0 — EU Digital Identity Wallet
Credential formats
mso_mdoc (ISO 18013-5), SD-JWT VC, JWT VC, BBS+ (ldp_vc)
Protocols
OpenID4VCI, OpenID4VP, SIOP v2, OAuth 2.0 PAR (RFC 9126), DCQL
Cryptography
ECDSA P-256 (COSE_Sign1), AES-256-GCM, BBS+ ciphersuites, HMAC chain audit
Trust & revocation
EU LOTL/TSL XAdES verification, ICAO PKD CMS verification, StatusList (RFC 9596)
Holder binding
AndroidKeyStore TEE-backed (StrongBox where available), WUA / WIA / Key Attestation
Server stack
REST API + PostgreSQL, software-HSM key vault with envelope encryption
EUDI Wallet
EU Digital Identity Wallet specification
ISO 18013-5 / -7
Mobile driving licence / mdoc — proximity & online
OpenID4VC
VCI & VP, SIOP v2, HAIP
RFC 9596
Bitstring status list
RFC 9126
Pushed Authorization Request
eIDAS 2.0
Levels of Assurance, trust topology
Talk to us about your integration.
We'll demo the backend on your scenario — onboarding, KYC, payment SCA, mobility, telecom — and walk you through what shipping it with real citizens looks like.
Technical support:
suport@fortrust.ro