Check an OpenID4VCI issuer
Each finding quotes the spec sentence it enforces.
PORT=8080 node packages/api/dist/index.js, then open http://127.0.0.1:8080/.
Read-only: GET requests only.
Fetches the issuer metadata, its authorization server metadata and the TLS certificate. Both well-known layouts are tried. Safe to run against an issuer you don't operate.
Issues a credential and sends test requests. Use an issuer you're allowed to probe, with test data.
A throwaway key is generated for the run and kept in memory only. The credential is parsed and discarded; only the findings are kept.
Pre-authorized code flow only. What the live flow supports
Results
Rules
Every check the doctor runs, with the sentence it enforces.
Coverage
How much of OpenID4VCI 1.0 the rules reach.
About
What it checks
The doctor reads an issuer's published metadata and, optionally, the responses of a live issuance, and checks them against OpenID4VCI 1.0 Final (16 September 2025) and the specifications it references. Each finding quotes the sentence it enforces and suggests a fix.
The checks are partial. Some requirements can't be observed from outside, and some need flows the doctor doesn't run. The Coverage page shows how much is reached.
How the score works
The score is the share of the checks that ran which passed, weighted by severity:
- A check derived from a MUST, or from a definition, weighs 3. A SHOULD-level check weighs 1.
- Advisories (MAY level) and recommendations don't count.
- A check fails if it reports a critical or warning finding. It counts once, however many findings it reports.
- Score = passed weight ÷ total weight. Grades: A from 90, B from 75, C from 60, D from 40.
Checks that couldn't run don't count either way; the report says how many there were. The score is not a conformance verdict.
Live flow and active probes
The live flow completes a pre-authorized code issuance against the issuer named in the offer. It uses anonymous access when the authorization server advertises it, Bearer tokens (DPoP with active probes, when advertised) and JWT key proofs. A deferred credential is polled up to three times, waiting the issuer's interval when it's at most 10 seconds.
For mdoc credentials it checks the issuer signature, the disclosed-item digests and the key binding. Certificate trust is not verified. Issuers that require encryption are supported when they offer ECDH-ES on P-256 with AES-GCM.
Not supported: the authorization code flow (it needs a person to log in), client authentication, and key or wallet attestations. When a flow can't run, the report says why.
Every live flow also runs the active probes: deliberately wrong or repeated requests sent after a successful issuance to see how the issuer handles them. The Live flow tab lists each one.
Privacy
- An issuer URL check sends only GET requests.
- A saved link keeps the findings, not the metadata or offer you checked.
- Pre-authorized codes and issuer state are redacted from everything the page shows.
- Live-flow keys and credentials stay in memory and are discarded after the run.
Not a certification
This is an advisory tool. For certification, use the OpenID Foundation conformance suite.