Cloud Identity Wallet

Cloud-hosted, multi-tenant verifiable credential wallet designed for issuers, holders, and verifiers operating in SSI- and eIDAS-aligned ecosystems.

It implements:

• OpenID for Verifiable Credential Issuance (OpenID4VCI) for credential issuance
• OpenID for Verifiable Presentations (OpenID4VP) for credential presentation

The project is designed to support a wide range of credential formats while enabling privacy-preserving disclosure and interoperability across EUDI-compatible systems.

⚠️ Project status
This repository is under active development. Core building blocks are being implemented incrementally and APIs may change.

Key Capabilities

This project focuses on server-side wallet capabilities.

Core Wallet Features

• Multi-Tenant Architecture
  Host multiple organizations and tenants in a single instance with strong data isolation.

• Modular Design
  Pluggable components for credential formats, storage backends, and key management systems.

• Webhook & Audit Logging
  Track credential issuance and presentation events for observability and compliance.

Standards & Interoperability

• OpenID4VCI (credential issuance)
• OpenID4VP (verifiable presentations)
• Support for standardized credential formats:
  • SD-JWT
  • ISO 18013-5 (mDL / mdoc)
  • W3C Verifiable Credentials Data Model

Privacy & Security

• Privacy-preserving selective disclosure
• Encrypted storage
• Secure key management abstractions
• Designed for compliance-driven environments (eIDAS / EUDI)

Architecture Overview

A detailed breakdown of components, trust boundaries, and protocol flows is available in ARCHITECTURE.md.

Build and Test

Prerequisites

• Rust & Cargo (latest stable version)
• An optional alternative linker for faster builds (see linking guide)

Setup

git clone https://github.com/ADORSYS-GIS/cloud-identity-wallet.git
cd cloud-identity-wallet

Running the application

cargo run

Backend implementations are selected with Cargo features. See the full feature matrix for supported memory, Redis, SQL, and KMS combinations.

Configuration

The application is configured via environment variables prefixed with APP_, using __ as the section separator. Key variables:

Variable	Default	Description
APP_SERVER__HOST	127.0.0.1	Bind address
APP_SERVER__PORT	3000	Listen port
APP_OID4VCI__CLIENT_ID	cloud-identity-wallet	OAuth2 client identifier
APP_OID4VCI__REDIRECT_URI	http://localhost:3000/api/v1/issuance/callback	OAuth2 redirect URI
APP_OID4VCI__PREFERRED_DISPLAY_LOCALES	en	Comma-separated locale prefixes tried in priority order when selecting credential display metadata (e.g. en,fr,de)
APP_OID4VCI__IACA_ROOT_PATHS	(empty)	Comma-separated paths to DER- or PEM-encoded IACA root certificate files (e.g. /certs/iaca-root.pem). An empty list is fail-closed: all ISO 18013-5 mDoc credential issuances will be rejected. A startup WARN is logged when no roots are loaded. Paths containing commas must be set via a config file instead of this variable.

Testing

You can run the full test suite with:

cargo test --workspace --all-targets --all-features

Or optionally with cargo-nextest for faster test execution:

cargo nextest run --workspace --all-targets --all-features

Contributing

Contributions are welcome and encouraged. Before contributing, please review the architecture documentation, which provides an overview of our architectural design. Also refer to the contributing guide for more details.
Discussions around standards compliance, interoperability, and extensibility are especially welcome.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.