OpenID for Verifiable Credential Issuance - Client

IMPORTANT this package is in an early development stage and currently only supports the pre-authorized code flow of OpenID4VCI!

Background

A client to request and receive Verifiable Credentials using the OpenID for Verifiable Credential Issuance ( OpenID4VCI) specification for receiving Verifiable Credentials as a holder/subject.

OpenID4VCI defines an API designated as Credential Endpoint that is used to issue verifiable credentials and corresponding OAuth 2.0 based authorization mechanisms (see [RFC6749]) that a Wallet uses to obtain authorization to receive verifiable credentials. W3C formats as well as other Credential formats are supported. This allows existing OAuth 2.0 deployments and OpenID Connect OPs (see [OpenID.Core]) to extend their service and become Credential Issuers. It also allows new applications built using Verifiable Credentials to utilize OAuth 2.0 as integration and interoperability layer. This package provides holder/wallet support to interact with OpenID4VCI capable Issuer systems.

Flows

The spec lists 2 flows. Currently only one is supported!

Authorized Code Flow

This flow isn't supported yet!

Pre-authorized Code Flow

The pre-authorized code flow assumes the user is using an out of bound mechanism outside the issuance flow to authenticate first.

The below diagram shows the steps involved in the pre-authorized code flow. Note that wallet inner functionalities (like saving VCs) are out of scope for this library. Also This library doesn't involve any functionalities of a VC Issuer

OpenID4VCI Client

The OpenID4VCI client is the main client you typically will want to use. It combines several lower level classes into a client you can use to finish the pre-authorized code flows.

Initiating the client

This initiates the client using a URI obtained from the Issuer using a link (URL) or QR code typically. We are also already fetching the Server Metadata

1import { OpenID4VCIClient } from '@sphereon/openid4vci-client';
2
3// The client is initiated from a URI. This URI is provided by the Issuer, typically as a URL or QR code.
4const client = await OpenID4VCIClient.initiateFromURI({
5  issuanceInitiationURI: 'openid-initiate-issuance://?issuer=https%3A%2F%2Fissuer.research.identiproof.io&credential_type=OpenBadgeCredentialUrl&pre-authorized_code=4jLs9xZHEfqcoow0kHE7d1a8hUk6Sy-5bVSV2MqBUGUgiFFQi-ImL62T-FmLIo8hKA1UdMPH0lM1xAgcFkJfxIw9L-lI3mVs0hRT8YVwsEM1ma6N3wzuCdwtMU4bcwKp&user_pin_required=true',
6  flowType: AuthzFlowType.PRE_AUTHORIZED_CODE_FLOW, // The flow to use
7  kid: 'did:example:ebfeb1f712ebc6f1c276e12ec21#key-1', // Our DID.  You can defer this also to when the acquireCredential method is called
8  alg: Alg.ES256, // The signing Algorithm we will use. You can defer this also to when the acquireCredential method is called
9  clientId: 'test-clientId', // The clientId if the Authrozation Service requires it.  If a clientId is needed you can defer this also to when the acquireAccessToken method is called
10  retrieveServerMetadata: true // Already retrieve the server metadata. Can also be done afterwards by invoking a method yourself.
11});
12
13console.log(client.getIssuer()); // https://issuer.research.identiproof.io
14console.log(client.getCredentialEndpoint()); // https://issuer.research.identiproof.io/credential
15console.log(client.getAccessTokenEndpoint()); // https://auth.research.identiproof.io/oauth2/token

Server metadata

The OID4VCI Server metadata contains information about token endpoints, credential endpoints, as well as additional information about supported Credentials, and their cryptographic suites and formats. The code above already retrieved the metadata, so it will not be fetched again. If you however not used the retrieveServerMetadata option, you can use this method to fetch it from the Issuer:

1import { OpenID4VCIClient } from '@sphereon/openid4vci-client';
2
3const metadata = await client.retrieveServerMetadata()

Access token from Authorization Server

Next we need to get an Access token from the OAuth2 Authorization Server using the token endpoint. This endpoint is found from the metadata if the server supports it. Otherwise a default location based on the issuer value from the Initiate Issuance Request is used.

1const accessToken = await client.acquireAccessToken({ pin: '1234' });
2console.log(accessToken);
3/**
4 * {
5 *   access_token: 'ey6546.546654.64565',
6 *   authorization_pending: false,
7 *   c_nonce: 'c_nonce2022101300',
8 *   c_nonce_expires_in: 2025101300,
9 *   interval: 2025101300,
10 *   token_type: 'Bearer',
11 * }
12 */

Getting the credential

Now it is time to get the credential. In order to achieve this, we will be using the metadata together with the access token, but first we will have to create a so-called Proof of Possession. Please see the Proof of Posession chapter for more information.

The Proof of Possession using a signature callback function. The example uses the jose library.

1
2const { privateKey, publicKey } = await jose.generateKeyPair('ES256');
3
4// Must be JWS
5async function signCallback(args: Jwt, kid: string): Promise<string> {
6  return await new jose.SignJWT({ ...args.payload })
7    .setProtectedHeader({ alg: args.header.alg })
8    .setIssuedAt()
9    .setIssuer(kid)
10    .setAudience(args.payload.aud)
11    .setExpirationTime('2h')
12    .sign(keypair.privateKey);
13}
14
15const callbacks: ProofOfPossessionCallbacks = {
16  signCallback
17}

Now it is time to get the actual credential

1const credentialResponse = await client.acquireCredentials({
2  credentialType: 'OpenBadgeCredential',
3  proofCallbacks: callbacks,
4  format: 'jwt_vc',
5  alg: Alg.ES256K,
6  kid: 'did:example:ebfeb1f712ebc6f1c276e12ec21#keys-1'
7});
8console.log(credentialResponse.credential)
9// JWT format. (LDP/JSON-LD is also supported by the client)
10// eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2YyI6eyJAY29udGV4dCI6WyJodHRwczovL3d3dy53My5vcmcvMjAxOC9jcmVkZW50aWFscy92MSIsImh0dHBzOi8vd3d3LnczLm9yZy8yMDE4L2NyZWRlbnRpYWxzL2V4YW1wbGVzL3YxIl0sImlkIjoiaHR0cDovL2V4YW1wbGUuZWR1L2NyZWRlbnRpYWxzLzM3MzIiLCJ0eXBlIjpbIlZlcmlmaWFibGVDcmVkZW50aWFsIiwiVW5pdmVyc2l0eURlZ3JlZUNyZWRlbnRpYWwiXSwiaXNzdWVyIjoiaHR0cHM6Ly9leGFtcGxlLmVkdS9pc3N1ZXJzLzU2NTA0OSIsImlzc3VhbmNlRGF0ZSI6IjIwMTAtMDEtMDFUMDA6MDA6MDBaIiwiY3JlZGVudGlhbFN1YmplY3QiOnsiaWQiOiJkaWQ6ZXhhbXBsZTplYmZlYjFmNzEyZWJjNmYxYzI3NmUxMmVjMjEiLCJkZWdyZWUiOnsidHlwZSI6IkJhY2hlbG9yRGVncmVlIiwibmFtZSI6IkJhY2hlbG9yIG9mIFNjaWVuY2UgYW5kIEFydHMifX19LCJpc3MiOiJodHRwczovL2V4YW1wbGUuZWR1L2lzc3VlcnMvNTY1MDQ5IiwibmJmIjoxMjYyMzA0MDAwLCJqdGkiOiJodHRwOi8vZXhhbXBsZS5lZHUvY3JlZGVudGlhbHMvMzczMiIsInN1YiI6ImRpZDpleGFtcGxlOmViZmViMWY3MTJlYmM2ZjFjMjc2ZTEyZWMyMSJ9.z5vgMTK1nfizNCg5N-niCOL3WUIAL7nXy-nGhDZYO_-PNGeE-0djCpWAMH8fD8eWSID5PfkPBYkx_dfLJnQ7NA

Using individual classes and methods instead of the client

Instead of using the OpenID4VCI Client, you can also use the separate classes if you want. This typically gives you a bit more control and options, at the expense of a bit more complexity.

Issuance Initiation

Issuance is started from a so-called Issuance Initiation Request by the Issuer. This typically is URI, exposed as a link or a QR code. You can call the IssuanceInitiation.fromURI(uri) method to parse the URI into a Json object containing the baseUrl and a IssuanceInitiationRequest JSON object

1import { IssuanceInitiation } from '@sphereon/openid4vci-client';
2
3const initiationURI =
4  'https://issuer.example.com?issuer=https%3A%2F%2Fserver%2Eexample%2Ecom&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FhealthCard&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FdriverLicense&op_state=eyJhbGciOiJSU0Et...FYUaBy';
5
6const initiationRequestWithUrl = IssuanceInitiation.fromURI(initiationURI);
7console.log(initiationRequestWithUrl);
8
9/**
10 * {
11 *    "baseUrl": "https://server.example.com",
12 *    "issuanceInitiationRequest": {
13 *      "credential_type": [
14 *        "https://did.example.org/healthCard",
15 *        "https://did.example.org/driverLicense"
16 *      ],
17 *      "issuer": "https://server.example.com",
18 *      "op_state": "eyJhbGciOiJSU0Et...FYUaBy"
19 *    }
20 * }
21 */

Getting OpenID4VCI Server and OIDC/OAuth2 metadata

The OpenID4VCI spec defines a server metadata object that contains information about the issuer and the credentials they support. Next to this predefined endpoint there are also the well-known locations for OpenID Connect Discovery configuration and Oauth2 Authorization Server configuration. These contain for instance the token endpoints. The MetadataClient checks the OpenID4VCI well-known location for the medata and existence of a token endpoint. If the OpenID4VCI well-known location is not found, the OIDC/OAuth2 well-known locations will be tried:

Example:

1import { MetadataClient } from '@sphereon/openid4vci-client';
2
3const metadata = await MetadataClient.retrieveAllMetadataFromInitiation(initiationRequestWithUrl);
4
5console.log(metadata)
6/**
7 * {
8 *  issuer: 'https://server.example.com',
9 *  credential_endpoint: 'https://server.example.com/credential',
10 *  token_endpoint: 'https://server.example.com/token',
11 *  jwks_uri: 'https://server.example.com/jwks',
12 *  grant_types_supported: ['urn:ietf:params:oauth:grant-type:pre-authorized_code'],
13 *  credentials_supported: {
14 *   OpenBadgeCredential: {
15 *     formats: {
16 *       jwt_vc: {
17 *         types: [
18 *           'https://imsglobal.github.io/openbadges-specification/ob_v3p0.html#OpenBadgeCredential',
19 *           'https://w3id.org/ngi/OpenBadgeExtendedCredential',
20 *         ],
21 *         binding_methods_supported: ['did'],
22 *         cryptographic_suites_supported: ['ES256'],
23 *       },
24 *     },
25 *   },
26 *  },
27 * }
28 */

Acquiring the Access Token

Now you will need to get an access token from the oAuth2 Authorization Server (AS), using some values from the IssuanceInitiationRequest payload. For now you can use the issuer hostname for the AS, as there is no way to know the AS from the Issuance Initiation for known until the following OpenID Ticket is resolved. So the token endpoint would become https:///token. The library allows to pass in a different value for the AS token endpoint as well, so you already can use a different AS if you know the AS upfront. If no AS is provided the issuer value from the Issuance Initiation Request will be used.

1import { AccessTokenClient, AuthorizationServerOpts } from '@sphereon/openid4vci-client';
2
3const clientId = "abcd" // This can be a random value or a clientId assigned by the Authorization Server (depends on the environment)
4const pin = 1234 // A pincode which is shown out of band typically. Only use when the pin-code is required from the Issuance Initiation object.
5
6// Allows to override the Authorization Server and provide other AS options. By default the issuer value will be used
7const asOpts: AuthorizationServerOpts = {
8  clientId
9}
10
11const accessTokenResponse = AccessTokenClient.acquireAccessTokenUsingIssuanceInitiation({
12  issuanceInitiation: initiationRequestWithUrl,
13  asOpts,
14  pin,
15  metadata
16})
17console.log(accessTokenResponse)
18/**
19 * {
20 *      access_token: "eyJhbGciOiJSUzI1NiIsInR5cCI6Ikp..sHQ"
21 *      token_type: "bearer",
22 *      expires_in: 86400
23 * }
24 */
25

Proof of Possession

Part of OpenID4VCI is the holder showing that they are in possession of a certain key, associated with the DID that will be the subject of the to be issued Verifiable Credential. This proof of possession will be created using a DID, it's associated keypair and the ProofOfPossessionBuilder class. This Builder can be initiated from a JWT object if you want to create a JWT yourself, or it can be build using the Initiate Issuance Request, Server metadata and some methods from the builder. Both approaches need a callback function to sign the JWT and optionally a callback to verify the JWT. The signature of the callback functions you need to implement are:

1export type JWTSignerCallback = (jwt: Jwt, kid: string) => Promise<string>;
2export type JWTVerifyCallback = (args: { jwt: string; kid: string }) => Promise<void>;

This is an example of the signature callback function created using the jose library.

1import { Jwt } from "@sphereon/openid4vci-client";
2
3const { privateKey, publicKey } = await jose.generateKeyPair('ES256');
4
5// Must be JWS
6async function signCallback(args: Jwt, kid: string): Promise<string> {
7  return await new jose.SignJWT({ ...args.payload })
8    .setProtectedHeader({ alg: args.header.alg })
9    .setIssuedAt()
10    .setIssuer(kid)
11    .setAudience(args.payload.aud)
12    .setExpirationTime('2h')
13    .sign(keypair.privateKey);
14}

Alongside signing, you can optionally provide another callback function for verifying the created signature with populating verifyCallback. The method is expected to throw errors in case problems with the JWT or it's signature are found. below is an example of such method. This example (like the previous one) uses jose to verify the jwt.

1async function verifyCallback(args: { jwt: string; kid: string }): Promise<void> {
2  await jose.compactVerify(args.jwt, keypair.publicKey);
3}

Some important interface around Proof of Possession:

1export enum Alg {
2  EdDSA = 'EdDSA',
3  ES256 = 'ES256',
4  ES256K = 'ES256K',
5}
6
7export interface JWTHeader {
8  alg: Alg; // REQUIRED by the JWT signer
9  typ?: string; //JWT always
10  kid?: string; // CONDITIONAL. JWT header containing the key ID. If the Credential shall be bound to a DID, the kid refers to a DID URL which identifies a particular key in the DID Document that the Credential shall be bound to. MUST NOT be present if jwk or x5c is present.
11  jwk?: JWK; // CONDITIONAL. JWT header containing the key material the new Credential shall be bound to. MUST NOT be present if kid or x5c is present.
12  x5c?: string[]; // CONDITIONAL. JWT header containing a certificate or certificate chain corresponding to the key used to sign the JWT. This element may be used to convey a key attestation. In such a case, the actual key certificate will contain attributes related to the key properties. MUST NOT be present if kid or jwk is present.
13}
14
15export interface JWTPayload {
16  iss?: string; // REQUIRED (string). The value of this claim MUST be the client_id of the client making the credential request.
17  aud?: string; // REQUIRED (string). The value of this claim MUST be the issuer URL of credential issuer.
18  iat?: number; // REQUIRED (number). The value of this claim MUST be the time at which the proof was issued using the syntax defined in [RFC7519].
19  nonce?: string; // REQUIRED (string). The value type of this claim MUST be a string, where the value is a c_nonce provided by the credential issuer. //TODO: Marked as required not present in NGI flow
20  jti?: string; // A new nonce chosen by the wallet. Used to prevent replay
21  exp?: number; // Not longer than 5 minutes
22}
23
24export interface Jwt {
25  header?: JWTHeader;
26  payload?: JWTPayload;
27}
28

The arguments requested by jose and @sphereon/openid4vci-client

1import { Jwt, ProofOfPossessionCallbacks } from "@sphereon/openid4vci-client";
2
3const callbacks: ProofOfPossessionCallbacks = {
4  signCallback,
5  verifyCallback
6}
7
8const keyPair = await jose.generateKeyPair('ES256');

Using the builder from metadata and access token response

Normally you would use the Proof of Possession builder using the server metadata and access token response together with the callbacks. There is however the possibility to use a JWT directly, which will be explained in the next section.

1import { ProofOfPossessionBuilder } from '@sphereon/openid4vci-client';
2
3const proofInput: ProofOfPossession = await ProofOfPossessionBuilder.fromAccessTokenResponse({
4  accessTokenResponse,
5  callbacks,
6})
7  .withEndpointMetadata(metadata)
8  .withClientId('s6BhdRkqt3')
9  .withKid('did:example:ebfeb1f712ebc6f1c276e12ec21/keys/1')
10  .build();
11console.log(proofInput);
12// {
13//   "proof_type": "jwt",
14//   "jwt": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImRpZDpleGFtcGxlOmViZmViMWY3MTJlYmM2ZjFjMjc2ZTEyZWMyMS9rZXlzLzEifQ.eyJpc3MiOiJzNkJoZFJrcXQzIiwiYXVkIjoiaHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJpYXQiOjE2NTkxNDU5MjQsIm5vbmNlIjoidFppZ25zbkZicCJ9.btetOcsJ_VOePkwlFf2kyxm6hEUvPRimf3M-Dn3Lmzcmt5QiPToXNWxe_0fEJlRf4Ith55YGB43ScBe6ScZmD1gfLELYQF7LLg97yYlx_Iu8RLA2dS_7EWzLD3ZIzyUGf_uMq3HwXGJKL-ihroRpRBvxRLdZCy-j62nAzoTsBnlr6n79VjkGtlxIjN_CLGIQBhc3du3enghY6N4s3oXFrxWMl7UzGKdjCYN6vSagDb0MURjdiDCsK_yX4NyNd0nGpxqGhVgMpuhqEcqyU0qWPyHF-swtGG5JVAOJGd_YkJS5vbia8UdyOJXnAAdEE1E62a2yUPahNDxMh1iIpS0WO7y6QexWXdb5fmnWDst89T3ELS8Hj2Vzsw1XPyk9XR9JmiDzmEZdH05Wf4M9pXUG4-8_7StB6Lxc7_xDJdk6JPbzFgAIhJa4F_3rfPuwMseSEQvD6bDFowkIiUpt1vXGGVjVm3N4I4Th4_A2QpW4mDzcTKoZq9MKlDGXeLQBtiKXmqs10Jvzpp3O7kBwH7Qm6VUdBxk_-wsWplUZC4IvCfv23hy2SyFnh5zC6Wtw3UcbrSH6LcD7g-RNTKe4fRekyDxqLRdEm60BOozgBoTNhnetCrQ3e7HrApj9EP0vqNyXdtGGWCA011HVDnz6lVzf5yijJB8hOPpkgYGRmHdRQwI"
15// }

Using the builder with a self-created JWT

You can build/create a JWT yourself. You would still use the callbacks to sign the JWT. Please be aware that you will have to use the c_nonce value from the Access Token response as nonce value!. You can provide another nonce using the jti property.

1import { Jwt, ProofOfPossessionBuilder, ProofOfPossessionCallbacks } from "@sphereon/openid4vci-client";
2
3const callbacks: ProofOfPossessionCallbacks = {
4  signCallback,
5  verifyCallback
6}
7
8const keyPair = await jose.generateKeyPair('ES256');
9
10// If you directly want to use a JWT, instead of using method on the ProofOfPossessionBuilder you can create JWT:
11const jwt: Jwt = {
12  header: { alg: Alg.ES256, kid: 'did:example:ebfeb1f712ebc6f1c276e12ec21#1', typ: Typ.JWT },
13  payload: { iss: 's6BhdRkqt3', nonce: 'tZignsnFbp', jti: 'tZignsnFbp223', aud: 'https://issuer.example.com' }
14};
15
16const proofInput: ProofOfPossession = await ProofOfPossessionBuilder.fromJwt({
17  jwt,
18  callbacks,
19})
20  .build();
21console.log(proofInput);
22// {
23//   "proof_type": "jwt",
24//   "jwt": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImRpZDpleGFtcGxlOmViZmViMWY3MTJlYmM2ZjFjMjc2ZTEyZWMyMS9rZXlzLzEifQ.eyJpc3MiOiJzNkJoZFJrcXQzIiwiYXVkIjoiaHR0cHM6Ly9zZXJ2ZXIuZXhhbXBsZS5jb20iLCJpYXQiOjE2NTkxNDU5MjQsIm5vbmNlIjoidFppZ25zbkZicCJ9.btetOcsJ_VOePkwlFf2kyxm6hEUvPRimf3M-Dn3Lmzcmt5QiPToXNWxe_0fEJlRf4Ith55YGB43ScBe6ScZmD1gfLELYQF7LLg97yYlx_Iu8RLA2dS_7EWzLD3ZIzyUGf_uMq3HwXGJKL-ihroRpRBvxRLdZCy-j62nAzoTsBnlr6n79VjkGtlxIjN_CLGIQBhc3du3enghY6N4s3oXFrxWMl7UzGKdjCYN6vSagDb0MURjdiDCsK_yX4NyNd0nGpxqGhVgMpuhqEcqyU0qWPyHF-swtGG5JVAOJGd_YkJS5vbia8UdyOJXnAAdEE1E62a2yUPahNDxMh1iIpS0WO7y6QexWXdb5fmnWDst89T3ELS8Hj2Vzsw1XPyk9XR9JmiDzmEZdH05Wf4M9pXUG4-8_7StB6Lxc7_xDJdk6JPbzFgAIhJa4F_3rfPuwMseSEQvD6bDFowkIiUpt1vXGGVjVm3N4I4Th4_A2QpW4mDzcTKoZq9MKlDGXeLQBtiKXmqs10Jvzpp3O7kBwH7Qm6VUdBxk_-wsWplUZC4IvCfv23hy2SyFnh5zC6Wtw3UcbrSH6LcD7g-RNTKe4fRekyDxqLRdEm60BOozgBoTNhnetCrQ3e7HrApj9EP0vqNyXdtGGWCA011HVDnz6lVzf5yijJB8hOPpkgYGRmHdRQwI"
25// }

Credential Issuance

Now it is time to request the actual Credential(s) from the Issuer. The example uses a DID:JWK. The DID:JWK should match the keypair created earlier.

1import { CredentialRequestClientBuilder, CredentialResponse, ProofOfPossessionArgs } from '@sphereon/openid4vci-client';
2
3const credentialRequestClient = CredentialRequestClientBuilder
4                                    .fromIssuanceInitiation(initiationRequestWithUrl, metadata)
5                                    .build()
6
7// In 1 step:
8const credentialResponse: CredentialResponse = await credentialRequestClient.acquireCredentialsUsingProof({
9  proofInput,
10  credentialType: 'OpenBadgeCredential', // Needs to match a type from the Initiate Issance Request!
11  format: 'jwt_vc' // Allows us to override the format
12})
13
14
15// Or in 2 steps:
16// const credentialRequest: CredentialRequest = await credentialRequestClient.createCredentialRequest(proofOpts, { format: 'jwt_vc' }) // Allows us to override the format
17// const credentialResponse: CredentialResponse = await credentialRequestClient.acquireCredentialsUsingRequest(credentialRequest)

Helper Functions

Several utility functions are available

convertJsonToURI:

Converts a Json object or string into an URI:

1import { convertJsonToURI } from '@sphereon/openid4vci-client';
2
3const encodedURI = convertJsonToURI(
4  {
5    issuer: 'https://server.example.com',
6    credential_type: ['https://did.example.org/healthCard', 'https://did.example1.org/driverLicense'],
7    op_state: 'eyJhbGciOiJSU0Et...FYUaBy',
8  },
9  {
10    arrayTypeProperties: ['credential_type'],
11    urlTypeProperties: ['issuer', 'credential_type'],
12  }
13);
14console.log(encodedURI);
15// issuer=https%3A%2F%2Fserver%2Eexample%2Ecom&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FhealthCard&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FdriverLicense&op_state=eyJhbGciOiJSU0Et...FYUaBy

convertURIToJsonObject:

Converts a URI into a Json object with URL decoded properties. Allows to provide which potential duplicate keys need to be converted into an array.

1import { convertURIToJsonObject } from '@sphereon/openid4vci-client';
2
3const decodedJson = convertURIToJsonObject(
4  'issuer=https%3A%2F%2Fserver%2Eexample%2Ecom&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FhealthCard&credential_type=https%3A%2F%2Fdid%2Eexample%2Eorg%2FdriverLicense&op_state=eyJhbGciOiJSU0Et...FYUaBy',
5  {
6    arrayTypeProperties: ['credential_type'],
7    requiredProperties: ['issuer', 'credential_type'],
8  }
9);
10console.log(decodedJson);
11// {
12//   issuer: 'https://server.example.com',
13//   credential_type: ['https://did.example.org/healthCard', 'https://did.example1.org/driverLicense'],
14//   op_state: 'eyJhbGciOiJSU0Et...FYUaBy'
15// }