The OpenID4VC High Assurance Interoperability Profile (HAIP) is a technical specification officially published by the OpenID Foundation in December 2025. It is playing a central role in shaping national and international digital identity wallet ecosystems.
1. What is the OpenID4VC High Assurance Interoperability Profile (HAIP)?
The OpenID4VC High Assurance Interoperability Profile (HAIP) defines a set of requirements for existing standards to ensure interoperability among credential Issuers, Wallets, and Verifiers in scenarios requiring high levels of security and privacy.
This technical specification aims to achieve high levels of security and privacy through the following characteristics:
- Authenticity of Claims: Ensuring with a high degree of confidence that the claims contained in a Credential or Presentation are valid and bound to the correct Holder. This includes policies and processes for collecting and maintaining information; Holder authentication during the issuance process; and measures to protect the authenticity of information both at rest (within the wallet) and during presentation. The scope of this technical specification includes: Securing the issuance process, protecting issued credentials, and providing mechanisms that enable Verifiers to access trustworthy information about Issuers.
- Holder Authentication: Ensuring with a high degree of confidence that a credential is presented by its legitimate Holder in a specific transaction. This requires proof of binding to the Holder, which can be verified through various methods. HAIP covers the secure presentation of key-bound credentials, as well as supporting Claim-based binding mechanisms when built on this functionality.
HAIP uses the “OpenID for Verifiable Credential Issuance” [OIDF.OID4VCI] and “OpenID for Verifiable Presentations” [OIDF.OID4VP] protocols as the foundation for credential issuance and presentation.
The supported credential formats include:
- IETF SD-JWT VC (as specified in [I-D.ietf-oauth-sd-jwt-vc])
- ISO mdoc (as specified in [ISO.18013-5]) – used for mobile driving licences and digital identity documents
Both credential formats can be issued through a single interaction with the Authorization Server.
High-Level Security (Security & FAPI Profile):
- Applies a security profile based on FAPI 2.0 (Financial-grade API)
- Uses DPoP (Demonstrating Proof-of-Possession) to bind access tokens to the sender (sender-constrained access tokens)
- Uses PKCE (S256) and Response Encryption with ECDH-ES / A128GCM
Key Binding & Attestation: Supports Wallet Attestation and Key Attestation through KB-JWT to ensure that only the legitimate Holder can present credentials.
2. HAIP in the European Digital Identity Wallet (EUDI Wallet)
HAIP (High Assurance Interoperability Profile) serves as the core set of rules for technical alignment within the European Digital Identity Wallet (EUDI Wallet) project. It helps ensure that digital wallets issued by any EU Member State can operate seamlessly and securely across all countries within the Union.
The specific application of HAIP within the EUDI Wallet ecosystem includes the following aspects:
a. Standardizing Credential Issuance and Presentation Processes
The EUDI Wallet operates through two main actions: receiving official documents from the government (Issuance) and presenting documents when required (Presentation). HAIP establishes common protocols for these two processes:
- Credential Issuance: Uses the OpenID4VCI protocol. When a citizen applies for or requests a government-issued Person Identification Data (PID) or attribute credentials (such as a driving licence or university degree), the process follows HAIP’s strict profile requirements.
- Credential Presentation: Uses the OpenID4VP protocol. When a citizen presents documents to a relying party (for example, a bank, an airport, or an online car rental service), the wallet securely transmits the data through this protocol.
b. Supporting Both Mandatory EU Data Formats
Europe requires EUDI Wallets to support both credential formats to accommodate different online and offline scenarios. HAIP seamlessly integrates both:
- ISO mdoc (ISO/IEC 18013-5): A traditional format optimized for in-person (offline) verification via NFC or QR codes (for example, traffic police checking a driving licence on the road).
- SD-JWT VC: A widely used web-based format optimized for online transactions through its Selective Disclosure feature. Citizens can prove that they are over 18 without revealing their date of birth or real name.
c. Ensuring the Highest Level of Assurance under eIDAS 2
Under the EU’s amended eIDAS Regulation, EUDI Wallets must achieve the highest security level (Assurance Level: High). HAIP addresses this through stricter technical requirements:
- Wallet Attestation: Issuers or Verifiers can check whether a wallet application is an official government-issued EUDI Wallet or whether it is running on a jailbroken or rooted device.
- Hardware Key Binding: HAIP requires the wallet’s cryptographic keys to be stored in the phone’s secure hardware chip (such as Secure Enclave on iOS or StrongBox on Android). This ensures that credentials cannot be copied to another device.
d. Applying Financial-Grade Security Standards (FAPI 2.0)
To protect EU citizens’ personal data from cyberattacks, HAIP applies the FAPI 2.0 (Financial-grade API) security profile to the EUDI Wallet.
- All API flows between the Wallet, Issuer, and Relying Party are protected using asymmetric encryption.
- The DPoP (Demonstrating Proof-of-Possession) mechanism is used to ensure that access tokens cannot be stolen and reused by attackers.
HAIP is the architectural core that helps turn the European Union’s vision of a secure, protected, and borderless digital wallet into a technical reality.
3. SAVYINT Digital ID Wallet: Advancing Secure and Interoperable Digital Identity
As the digital identity landscape moves towards greater interoperability and high-assurance standards, Digital ID Wallets are becoming a key component of trusted digital ecosystems. Building on the principles of secure credential issuance, storage, and presentation highlighted by OpenID4VC HAIP, SAVYINT’s Digital ID Wallet solution aims to empower individuals to securely manage and use their digital identities and credentials across digital services.
With a focus on security, interoperability, and user-centric digital identity management, SAVYINT is committed to supporting organizations in developing trusted digital identity ecosystems and advancing the adoption of digital identity wallet solutions.
Connect with SAVYINT to explore our Digital ID Wallet solution and discover new opportunities to build secure, interoperable, and trusted digital identity experiences.
Source: https://openid.net/specs/openid4vc-high-assurance-interoperability-profile-1_0.html#section-1-3.1
