Download the PHP package malikzohaib/openid4vp-eudi-verifier without Composer

EUDI PHP SDK

A framework-agnostic PHP SDK for building server-side EUDI Wallet verifier integrations. It provides OpenID for Verifiable Presentations (OpenID4VP) orchestration, DCQL requests, HAIP 1.0 request and encrypted response handling, SD-JWT VC verification, trust resolution, QR rendering, and test utilities.

This is an independent, community-developed project and is not an official European Commission or EUDI Wallet reference implementation.

This project is under active development. Review the implementation and your applicable regulatory, security, and interoperability requirements before using it in production.

Requirements

• PHP 8.2 or later
• OpenSSL, JSON, and zlib PHP extensions
• Composer 2

Installation

After the package has been published on Packagist:

Before it is on Packagist, another project can install it directly from GitHub:

Replace the example GitHub URL with the actual repository URL. For production projects, install a tagged release such as ^1.0 instead of dev-main.

Composer loads all SDK namespaces automatically through vendor/autoload.php:

Pass the request to a configured Eudi\VerifierCore\Application\VerifierService. A host framework or extension must supply implementations for session persistence and request-object signing; the SDK deliberately keeps these integration concerns behind interfaces.

Packages and namespaces

The component-level composer.json files are retained so components can later be published independently. Installing malikzohaib/openid4vp-eudi-verifier installs and autoloads all components as one package.

Integration flow

1. Create a VerifierConfig for your public verifier URL, client identifier, wallet authorization endpoint, response mode, and profile.
2. Implement SessionStoreInterface using durable, concurrency-safe storage.
3. Implement RequestObjectSignerInterface, normally with a production certificate-backed signer.
4. Register the credential format handlers you accept in CredentialHandlerRegistry.
5. Call VerifierService::start() with a PresentationRequest.
6. Expose the returned request URI and redirect or display the authorization URI as a QR code.
7. Pass the wallet's form body to VerifierService::handleDirectPost().
8. Read verified credentials only from the completed session's verification result.

For the exact HAIP 1.0 redirect call path and security behavior, see HAIP-1.0.md.

Security notes

• Never use the demo HMAC signer, fake wallet, demo issuer, or in-memory session store in production.
• Keep response-decryption private keys server-side and isolate them per transaction.
• Use an atomic, single-use session store to prevent replay and concurrent consumption.
• Configure issuer trust anchors explicitly and validate certificates according to your trust framework.
• Credential status is fail-closed unless a status-list token fetcher is configured.
• Terminate TLS only in trusted infrastructure and do not log credentials, presentations, private keys, or authorization responses.

Please report vulnerabilities according to SECURITY.md, not through a public issue.

Development

See CONTRIBUTING.md for contribution and release guidance.

Publishing

1. Move this directory into its own public GitHub repository (or publish it with a subtree split).
2. Confirm that homepage, support, and README URLs match the public repository.
3. Push the default branch and confirm the GitHub Actions build passes.
4. Register the repository at Packagist and enable its GitHub hook.
5. Create a SemVer tag such as v1.0.0; do not add a version field to composer.json.

Consumers can then install a stable line with composer require malikzohaib/openid4vp-eudi-verifier:^1.0.

License

Released under the MIT License.