OEM Cookbook · Wallet Attestation onboarding · HAIP §5.11

Get your OEM app a Wallet Attestation.

A Wallet Attestation (WA, sometimes called WIA) is a short-lived JWT that binds the wallet's ECDSA-P256 public key to a claim from the tenant that the wallet is legitimate. HAIP-conformant verifiers demand it (via OAuth-Client-Attestation) to distinguish a real European Digital Identity Wallet from a scripted client. This cookbook covers the runtime mint via /wallet-attestation.ashx and the presentation of the WA to verifiers.

Mint. The WA JWT is HS256-signed with a per-tenant HMAC key (see /wallet-attestation.ashx). The tenant's OIDC access token gates access; the mint binds the wallet's public JWK to the acting sub and returns a JWT with typ=wallet-attestation+jwt.

1 OEM onboarding

Email info@aloaha.com with:

Company legal name + registration number, jurisdiction, VAT ID.
Technical contact: name, e-mail, phone.
OIDC client name + redirect URIs (your app's custom URL scheme).
Intended deployment scope (regions, expected user count in year 1).

Aloaha provisions your OEM OIDC client_id against a tenant of your choice (shared managed, per-OEM subdomain, or on-premise). WA minting works out of the box.

2 Mint a WA (C3)

POST /wallet-attestation.ashx with the wallet public JWK and an optional nonce. Body:

POST /wallet-attestation.ashx HTTP/1.1
Authorization: Bearer <OIDC access token>
Content-Type: application/json

{
  "walletPublicJwk": { "kty":"EC", "crv":"P-256", "x":"...", "y":"..." },
  "nonce": "<from verifier request, or omit>"
}

Response:

{
  "wallet_attestation": "<compact JWT>",
  "token_type":         "wallet_attestation+jwt",
  "expires_in":         86400,
  "iat": <unix>, "exp": <unix>,
  "sub":                "<RFC 7638 JWK thumbprint of walletPublicJwk>",
  "iss":                "https://<tenant>/wallet-attestation"
}

The JWT header carries typ=wallet-attestation+jwt (hyphen — matches HAIP §5.11); the response body's token_type field uses underscore. Cache the JWT until exp - 60s.

3 Present the WA on OID4VP responses

Attach the WA JWT as an HTTP header on the direct_post to the verifier's response_uri:

OAuth-Client-Attestation: <WA JWT>

Verifiers advertise WA requirement in their JAR's client_metadata. When absent, presenting the WA anyway is harmless — conformant verifiers ignore unknown headers. See Present cookbook for where in the flow to attach.

4 Rotation + revocation

The per-tenant HMAC key is stored server-side; token expiry is 24 h so a compromise window is bounded. In case of suspected compromise, contact info@aloaha.com and the tenant's HMAC key is rotated (all outstanding WAs invalidated). No client-side action required beyond fetching a fresh WA on the next request.

Next: Vault sync → Previous: present API reference