Credentials
An EUDI Wallet credential is a digitally issued, verifiable statement of fact about a natural or legal person — such as their identity, a qualification, an entitlement, or a status — that is:
- issued by an accountable authority (public or private),
- held and controlled by the individual in their EU Digital Identity Wallet, and
- presented by that individual, at their own discretion, to any party that needs to verify the fact.
A credential is the digital counterpart of a physical document of proof (ID card, driver's licence, diploma, membership card). It serves the same purpose and carries legal recognition under the eIDAS 2.0 Regulation, but can be verified instantly and reliably without contacting the issuer.
Key Characteristics
| Characteristic | Meaning |
|---|---|
| Verifiable | Any receiving party can confirm the credential is genuine, unaltered, and issued by a legitimate authority — on their own, at the moment of use. |
| Holder-controlled | Only the wallet holder decides when a credential is presented and to whom. Nothing is shared automatically. |
| Selectively shareable | The holder can reveal only the specific facts required (e.g. "over 18") while withholding everything else (name, birthdate, address). |
| Legally recognized | Depending on its category (see below), a credential carries defined legal effect across all EU Member States. |
| Issuer-accountable | Every credential is traceable to an identifiable issuer who vouches for its content. |
The Three Roles
Every credential exists within a triangle of trust:
| Role | Who | Responsibility |
|---|---|---|
| Issuer | An authority or organization entitled to attest a fact | Issues the credential based on an authentic source and stands behind its correctness |
| Holder | The person the credential is about | Stores the credential in their wallet and decides on every presentation |
| Verifier (Relying Party) | Any party that needs proof of a fact about a person | Requests and checks the credential — without contacting the issuer |
Legal Categories
eIDAS 2.0 distinguishes credential categories by who may issue them and how much legal weight they carry:
| Category | Full Name | Issuer | Legal Significance | Analog Equivalent |
|---|---|---|---|---|
| PID | Person Identification Data | Designated national authority | The foundational identity credential (name, date of birth, etc.); anchors trust for everything else | |
| EAA | Electronic Attestation of Attributes | Any qualified public or private attestation provider | Legally recognized proof of any attribute (diploma, membership, entitlement) | |
| QEAA | Qualified EAA | Qualified Trust Service Provider (QTSP), under strict supervision | Highest evidentiary strength; comparable to a qualified electronic signature | |
| PUB-EAA | EAA issued by a public sector body | Government body | Recognized EU-wide without additional qualification |
Note: A mobile driving licence (mDL) is a prominent real-world example. It follows its own international rulebook but conceptually belongs to the same family of attestations.
What a Credential Is Not
- Not a copy of a database record. It is a self-contained proof; the verifier does not query the issuer's systems.
- Not an account or login. It is a portable statement of fact, independent of any single service.
- Not automatically visible to anyone. No party — including the issuer — learns when or where the holder uses it.
- Not tied to one technical format. Different technical envelopes exist (e.g. W3C Verifiable Credentials, ISO mdoc, SD-JWT VC). These are interoperable implementation choices and do not change what a credential is or means legally.
The paradigm shift from paper-based proofs and IDs
The trust triangle has long existed in the analog world: issuer (authority) → holder (citizen) → verifier (case worker, checkout). But credential are not just "a scanned physical card as a PDF". They are equivalents and digitize this whole model. It is a new primitive that preserves analog properties (offline presentation, unobservability) and adds digital ones ( data minimization, cryptographic verifiability, revocability).
Analog equivalents
National ID card ≈ PID
Driver's license, official certificate from a register ≈ PuB-EAA
Membership/loyalty card ≈ EAA
Notarized/qualified certified document ≈ QEAA
Where they differ – and why that makes the difference:
| Property | Physical proof | Credential |
|---|---|---|
| Selective disclosure | No – an ID card reveals name, address, and date of birth when proving age | Yes – only "≥18" without the date of birth |
| Unobservability | Issuer does not learn about the presentation | Same (unlike federated login) |
| Forgery/copying | Physical security features, copyable | Cryptographic signature + key binding against replay/transfer |
| Revocation | Hard to invalidate mid-life | Status/revocation mechanisms (e.g. Token Status List) |
| Verification | Visual (hologram, features) | Signature chain to the trust anchor |
| Correlatability | Card number as a tracking feature | Reducible (batch issuance, salted disclosures) |
The paradigm shift away from centralized ID
The break with previous identity models in the digital space lies in the decoupling of issuance and presentation.
| Dimension | Federated model (SAML / OIDC) | Wallet/attestation model |
|---|---|---|
| Parties per transaction | IdP online in the loop | Issuer offline, not involved |
| Trust establishment | Bilateral federation, per transaction | Signature verification against trust anchor / trust list |
| Data sovereignty | With the IdP / directory | With the Holder (wallet) |
| "Phone-home" | Yes – IdP learns of every login | No – Issuer does not learn of the presentation |
| Data minimization | Hard (IdP delivers attribute bundles) | Built in (selective disclosure, predicates like "≥18") |
In the federated model, the identity provider is involved in every login and learns where the user authenticates. In the wallet model, the Issuer issues once; afterwards the Verifier verifies cryptographically and without contacting the Issuer. This restores the privacy property of the physical card (no one learns where I present it) in the digital world – and adds data minimization, which is not possible at all in the analog world. The shift is thus: from account-/directory-centric to proof-centric, and from "ask the issuer every time" to "verify the signature".