The verifier sends an authorization request (by redirect, QR code or the browser Digital Credentials API) describing the credentials and claims it needs in DCQL, the Digital Credentials Query Language, plus a nonce and its client identifier; the wallet answers with a vp_token containing SD-JWT VC presentations with key-binding JWTs or mdoc device responses. Response modes include direct_post and its encrypted variant direct_post.jwt.
Verifier authentication is part of the protocol: client identifier prefixes such as x509_san_dns or verifier_attestation let the wallet show the user who is asking. The High Assurance Interoperability Profile (HAIP) pins the options for the EU wallet ecosystem. OpenID4VCI (Final 1.0, September 2025) is the companion protocol for issuance.