ForTrust dWallet
Demo Relying Party (test client)
Test client showing how a third-party application authenticates an EUDI Wallet user via ForTrust.

Sign in with ForTrust Wallet

Scope: Identity (PID) Age 18+ Pseudonymous (anonymous) Network access (PID) WiFi credential (advanced)

The WiFi credential scope requires a separate WiFi attestation pre-issued in the wallet. If the wallet only carries an mdoc PID, use Network access (PID) instead — it grants access on the identity the user already has.

Sign in with ForTrust

Click → redirect to ForTrust → scan the QR or tap "Open wallet" → claims appear live.

⭐

Demo: Premium content with recurring mandate

Three independent steps linked by the same pairwise pseudonym emitted by the wallet — the RP, the bank and the verifier all know it's the same user without learning their identity.

🔗 holder_pseudonym = sha256:<wallet pairwise_sub> · same value across all 3 steps
1

Sign mandate

Online · on bank / merchant

The user opens the bank app, scans a QR with the EUDI wallet, and cryptographically signs a mandate (PSD2 Art.18). Server stores holder_pseudonym + cap + cycle.

🎟️ All 3 demos (Pass Hub)
2

Premium access

Online · any RP site

On a gated content site, the user logs in pseudonymously. Server derives holder_pseudonym and queries the mandate table. Returns only premium_status=active/none — no name, no ID.

⭐ Scan QR & sign in
3

Verify on-site

Proximity · NFC at merchant

At entry/delivery, the operator taps the wallet with the validator's NFC reader. The validator sees the same holder_pseudonym and shows "Subscription active · PAID" — offline, identity-free.

📱 NFC TAP on validator

What the demo RP sends to ForTrust

client_id
demo.rp.fortrust.ro
redirect_uri
https://dwallet.fortrust.ro/oidc/demo/callback/
nonce
UUGHMf72quP7VP3oBU4nfL_9kaqZNcC1
state (CSRF)
a70dI3Zh-D-oSRxhWn0OGhjcQtv-0QxZ
scope
openid profile eudi_pid
response_type
vp_token

Full request URL:

https://dwallet.fortrust.ro/oidc/authorize/?client_id=demo.rp.fortrust.ro&redirect_uri=https%3A%2F%2Fdwallet.fortrust.ro%2Foidc%2Fdemo%2Fcallback%2F&nonce=UUGHMf72quP7VP3oBU4nfL_9kaqZNcC1&scope=openid%20profile%20eudi_pid&state=a70dI3Zh-D-oSRxhWn0OGhjcQtv-0QxZ&response_type=vp_token

The flow (end-to-end)

  1. The user taps Sign in → the browser issues GET /oidc/authorize/
  2. ForTrust returns a page with the QR and starts polling /oidc/userinfo/{session_id}/
  3. The user scans the QR with the EUDI wallet (or taps "Open wallet" on the same device)
  4. The wallet posts POST /oidc/response/ carrying the vp_token
  5. ForTrust verifies signature, trust chain and policy, marks the session completed
  6. The browser receives the verdict, renders the claims, and the RP is notified at redirect_uri?code=&state=
  7. The RP calls GET /oidc/userinfo/{session_id}/ → receives the verified claims