Workflows

How users, issuers, holders and verifiers move through Sunbird RC — from onboarding to verification.

1

User registration and onboarding

Users can join a registry in three ways:

• Self-registration

• Registration via invitation

• Integration with existing registries

2

Verifiable credential issuance

The issuer creates the credential and digitally signs it using a cryptographic key that only the issuer can use (as JSON-LD, JWT or SD-JWT, depending on the configured credential format).

The signature is generated with the issuer's private key and attached to the credential, so verifiers can confirm the credential hasn't been altered since it was issued. The public key associated with the issuer's private key can also be included in the credential, letting verifiers check the signature.

3

Verifiable credential storage

Once issued, the credential is stored in an eLocker, digital wallet or other digital storage controlled by the credential holder. The wallet gives the holder a secure, convenient way to manage and share their credentials with others.

4

Verifiable credential verification

When the holder presents a credential to an accepting party or verifier — such as a potential employer — the verifier checks its authenticity using cryptographic techniques. Verifying the issuer's digital signature confirms that the credential hasn't been tampered with since it was issued.

Wallet-based flows

Sunbird RC also supports standards-based flows that work with any compliant wallet, not just a Sunbird-built one.

Issuance (OpenID4VCI)

The issuer publishes a credential offer; the wallet resolves it, exchanges a pre-authorized code for an access token, and fetches the signed credential directly into wallet storage — a standardized, wallet-interoperable alternative to manual download.

Verification (OpenID4VP)

The verifier describes the claims it needs using DCQL; the wallet returns a signed presentation containing only those claims, which the verifier checks against the issuer's public key.