Skip to main content

Online vs. Proximity

When a Relying Party asks a person to present a credential from their EUDI Wallet, the request happens in one of two settings. Everything else — which app you use, which data format arrives, how you check the result — follows from which of the two you are in. The mental model is simple: if it happens over the web, it is Online; if it happens in person, it is Proximity.

When do I choose which?​

You usually do not choose freely — the use case decides for you. Match the setting to where the person actually is.

Online — the person is somewhere else:

  • Opening a bank account from home
  • Signing up for a service or verifying your age on a website
  • Logging in to a public-sector portal
  • Renting a car through an app before you arrive

Proximity — the person is right in front of you:

  • Proving your age at a store checkout or a bar
  • Showing a driving licence during a roadside check
  • Checking in at a hotel reception
  • Boarding or entering a venue with a ticket or entitlement
  • You cannot guarantee access to the internet (offline)

Credentials must be issued the right way​

To cover both use cases, the EUDI Wallet relies on two different technical credential formats — not because one is better than the other, but because Online and Proximity grew out of two different standards worlds that each already had a proven way of doing things:

  • SD-JWT VC comes from the web-identity world. It builds on formats already used for online authentication (JSON, JWTs), extended with selective disclosure so a person can reveal only some attributes. It is the format used for Online verification.
  • ISO mdoc (mobile document, secured with an MSO — Mobile Security Object) comes from the world of physical, standardized ID documents such as the mobile driving licence. It is built to work reliably in person, including offline, over a local connection like a scanned QR code or NFC. It is the format used for Proximity verification.

Rather than forcing everyone onto a single new format, the ecosystem supports both — each optimized for the setting it is used in.

What this means for a credential: a single credential is issued in one specific format. A PID issued as SD-JWT VC and a PID issued as ISO mdoc contain the same information, but are not interchangeable files — a wallet must hold the format your use case needs, and your Relying Party integration must request and read that same format.

Tip

As a Relying Party, all you really need to decide is how you want to access this data — Online or Proximity — and use the matching format. But keep this constraint in mind: the credential issuer must have issued the credential in that specific format. If a wallet only holds a credential as SD-JWT VC, it cannot be used in a Proximity flow that requires ISO mdoc, and vice versa.