A wallet for testing EUDI issuers and verifiers, in the browser, on the command line and over an HTTP API. It speaks OpenID4VP 1.0, OpenID4VCI 1.0 and HAIP 1.0 with SD-JWT VC and mdoc credentials. It also includes other parts of the ecosystem: a registrar (new in 3.0.0), PID templates, a demo issuer and verifier, a decoder and a debug proxy.
Try it online: a shared public demo runs at https://eudi-test.dev. The newest beta runs at https://preview.eudi-test.dev.
A wallet for testing your issuer or verifier. Accept credential offers and answer presentation requests from the web UI, the CLI or the HTTP API. Every exchange shows up in the activity log with its requests and responses. Debug mode reports what an issuer or verifier gets wrong and carries on. Strict mode refuses. → Wallet, presenting, issuing, UI automation
HAIP and ARF checks. --haip checks verifiers and issuers against HAIP 1.0. --arf (new in 3.0.0) checks how they authenticate under the ARF: access and registration certificates, revocation, and whether a verifier asks for more than it registered. → HAIP, ARF checks for verifiers and for issuers
A registrar and a catalogue of attestations. (new in 3.0.0) Register a verifier or an issuer and get its access certificate and registration certificate (ETSI TS 119 411-8, TS 119 475), ready for verifier_info or issuer_info. The catalogue lists attestation types (EC TS11). Each type links a schema for each format, a rulebook and a trusted list (by default the list of its category). → Registrar, curl walkthrough
PIDs and credential templates. The EUDI PID and the German, Italian and Dutch PIDs are built in as SD-JWT VC and mdoc, with sample identities. The Italian and Dutch PIDs are new in 3.0.0. Templates define your own credentials, and --credentials (new in 3.0.0) loads them on every start. → Templates, startup credentials
A demo issuer and verifier. The wallet also serves an issuer and a verifier. Both pass the OIDF conformance plans for issuers and verifiers. → Wallet server, demo conformance
Developer tools. Decode credentials, requests, offers and trusted lists, validate signatures and status, scan QR codes, generate DCQL queries, and watch live wallet traffic through a proxy. → Decode, validate, issue, proxy
Deployment options. A single binary, a Docker image, a Helm chart and a Testcontainers module, with state in files, memory or Postgres. → Docker, storage, public demo hosting
OpenID Certified. The wallet is certified for OpenID4VP 1.0 and OpenID4VCI 1.0 with HAIP 1.0. → Certification, conformance results, spec compliance
Never use real credentials (see SECURITY.md).
brew install eudi-dev/tap/eudi-dev
eudi wallet serve --pid # wallet UI at http://localhost:8085 with PIDs
eudi wallet accept 'openid4vp://authorize?...'
eudi registrar verifiers add --name "Example Shop" --purpose "Age check" --dcql query.json # new in 3.0.0
eudi decode credential.txtOr with Docker:
docker run -p 8085:8085 -p 8086:8086 ghcr.io/eudi-dev/eudi-dev→ What's new in 3.0.0, Examples for end-to-end recipes, and all documentation
| Method | Command |
|---|---|
| Homebrew (macOS and Linux) | brew install eudi-dev/tap/eudi-dev installs eudi with shell completion |
| Binaries | GitHub Releases |
| Go | go install github.com/eudi-dev/eudi-dev/v3@latest installs eudi-dev. The docs use eudi, so link it: ln -s "$(go env GOPATH)/bin/eudi-dev" "$(go env GOPATH)/bin/eudi" |
| Docker | docker pull ghcr.io/eudi-dev/eudi-dev. The default command starts a wallet with PIDs and keeps state in memory (guide) |
| Kubernetes | helm install my-release oci://ghcr.io/dominikschlosser/charts/eudi-dev (chart) |
| Java tests | testcontainers-eudi starts the wallet in Docker and drives it from Java |
| Source | git clone https://github.com/eudi-dev/eudi-dev.git && cd eudi-dev && go build -o eudi . |
The Go module path is github.com/eudi-dev/eudi-dev/v3. Each major version has its own suffix, so v2 releases install from github.com/eudi-dev/eudi-dev/v2 (2.7.1 and later) or github.com/dominikschlosser/eudi-dev/v2 (up to 2.7.0). Earlier v2 tags (up to v2.4.2) have an incorrect module path. Install them from release binaries or build them from source.
A beta, such as v3.0.0-beta.1, is a GitHub prerelease. You only get it when you ask for it:
| Method | Command |
|---|---|
| Online | https://preview.eudi-test.dev runs the newest beta |
| Docker | docker pull ghcr.io/eudi-dev/eudi-dev:beta gets the newest release, betas included. For repeatable runs, pin the exact tag, such as :v3.0.0-beta.1 |
| Go | go install github.com/eudi-dev/eudi-dev/v3@v3.0.0-beta.1. @latest installs a beta only while its major version has no stable release |
| Binaries | Download them from the prerelease on GitHub Releases. The binaries aren't signed, so macOS blocks a binary downloaded in the browser. Run xattr -d com.apple.quarantine eudi to unblock it |
| Java tests | testcontainers-eudi publishes a matching beta, such as 3.0.0-beta.1. Maven only uses it when you set that version |
Homebrew and the latest Docker tag stay on the newest stable release. When a stable release is the newest version, beta points to it too.
eudi [--json] [--no-color] [-v] <command> [flags] [input]
| Command | Purpose | Docs |
|---|---|---|
wallet |
The testing wallet: serve, accept, scan, list, logs and more |
wallet |
registrar |
Register verifiers and issuers, then issue, revoke and activate their certificates (new in 3.0.0) |
registrar |
catalog |
List, add and remove attestation types (new in 3.0.0) | catalogue |
trust |
Show and export the wallet's trusted lists and CA, put your CAs on them and add external lists | trusted lists |
issue |
Generate SD-JWT, JWT or mdoc test credentials | issue |
templates |
Manage credential templates | templates |
decode |
Inspect credentials, OpenID4VCI and OpenID4VP requests, and trusted lists | decode |
validate |
Verify signatures, expiry and revocation status | validate |
dcql |
Generate a DCQL query from a credential | dcql |
proxy |
Debug proxy for wallet traffic with a live dashboard | proxy |
decoder |
Decoder web UI | decoder |
completion |
Shell completion (eudi completion install) |
Input is a file path, a URL, a raw credential string or stdin. --json prints one JSON document on stdout for scripts, and messages go to stderr (ADR 0020). -v adds detail such as x5c chains, device keys and digest IDs.
Security: Anyone with network access to the wallet port controls its credentials and registered relying parties. The wallet binds
127.0.0.1unless--listensets another address. Use localhost or an isolated test network and store test data only. For public hosting, use the--demoprofile (see public demo hosting).
| Format | Description |
|---|---|
SD-JWT VC (dc+sd-jwt) |
Disclosures, _sd resolution, key binding JWT. Signatures: ES256/384/512, RS256/384/512, PS256/384/512 |
mdoc (mso_mdoc) |
CBOR IssuerSigned and DeviceResponse, COSE_Sign1 issuerAuth, MSO |
JWT VC (jwt_vc_json) |
Plain W3C JWT Verifiable Credentials, presented unchanged |
| OpenID4VCI and OpenID4VP | Credential offers and authorization requests with the schemes openid-credential-offer://, haip-vci://, eu-eaa-offer://, openid4vp://, haip-vp://, eudi-openid4vp:// and eu-eaap:// |
| ETSI trusted lists | TS 119 602 lists of trusted entities |
Spec compliance lists what is implemented for each specification, and the flow diagrams show the issuer and verifier interactions.
| Tool | What it tests | Runs locally | Scriptable |
|---|---|---|---|
| eudi-dev | your issuer or verifier | yes | CLI and HTTP API |
| Animo OpenID4VC Playground | your wallet | self-hostable | no, web UI |
| EUDIPLO Playground | your wallet | self-hostable | no, web UI |
| EUDI reference issuer and verifier | your wallet | issuer only | no, web UI |
| EUDI Web Wallet Tester | your issuer, OID4VCI only | yes | no, web UI |
| EUDI reference wallet (Android, iOS) | your issuer or verifier | on a device | no |
| Procivis One trial apps | your issuer or wallet | on a device | no |
| Multipaz | your wallet or issuer, and proximity | SDK, apps, hosted issuer and verifier | no |
| polaris-oid4vp | your wallet: OpenID4VP 1.0 + HAIP, SD-JWT VC, direct_post.jwt |
yes, pip install |
CLI, a verdict line per presentation |
| Paradym debuggers | one credential, decoded | no | no |
| SDKs: walt.id, Sphereon, Credo, Procivis One | whatever you build | yes | as you write it |
When to use something else:
- To certify your own implementation, use the OpenID Foundation certification program.
- To test a wallet, point it at one of the hosted issuer or verifier services above.
- To ship a product, use an SDK. The Go packages in this repository are internal (
internal/). - For proximity flows (BLE, NFC), use Multipaz. eudi-dev implements OID4VP over HTTP.
- To read a single credential, use a hosted decoder.
eudi-dev v2.3.7 is OpenID Certified™ for the OpenID4VP 1.0 and OpenID4VCI 1.0 wallet profiles with HAIP 1.0, for both SD-JWT VC and mdoc credentials.
| Certification | Certified flows | Date |
|---|---|---|
| OpenID4VP 1.0 + HAIP 1.0 | Presentation using direct_post.jwt |
18 September 2026 |
| OpenID4VCI 1.0 + HAIP 1.0 | Wallet-initiated issuance and issuer-initiated issuance with offers by value or reference | 3 September 2026 |
This repository has its own conformance results and a runbook. The OpenID Certified mark is a trademark of the OpenID Foundation and is used under its mark usage terms.
No EU affiliation: This is an independent open source project. The European Commission and the European Union do not endorse it and it has no affiliation with them. "EUDI" refers to the target ecosystem (European Digital Identity). For official EUDI Wallet resources see the eu-digital-identity-wallet organization.
Apache-2.0
Fonts: The web pages use IBM Plex Sans and IBM Plex Mono by IBM. They are bundled unmodified under the SIL Open Font License 1.1. See internal/webui/fonts.