Configure Wallet Provider

To enable wallet providing, you must configure a wallet provider instance with three required sections: wallet app attestation, wallet unit attestation, and wallet registration policy.

Minimal configuration

Here's the minimum required configuration to enable wallet provider functionality:

walletProvider:
  PROCIVIS_ONE:                    # Instance name (choose any name)
    type: PROCIVIS_ONE             # Must be exactly "PROCIVIS_ONE"
    display: walletProvider.procivisOne
    params:
      public:
        walletName: "My Wallet"
        walletLink: "https://example.com"
        walletRegistration: OPTIONAL
        walletAppAttestation:
          expirationTime: 86400
          integrityCheck:
            enabled: false
        walletUnitAttestation:
          expirationTime: 2678400
        deviceAuthLeeway: 60

The instance name (PROCIVIS_ONE in this example) can be any identifier you choose. However, the type field must be exactly PROCIVIS_ONE to invoke the correct provider implementation.

Wallet registration policy

The wallet registration policy controls whether wallets must register with the provider to obtain attestations.

walletRegistration: OPTIONAL

Policy options:

• DISABLED - Wallets cannot register or obtain attestations
• OPTIONAL - Wallets may register to obtain attestations but can function without them
• MANDATORY - Wallets must register and obtain attestations to function

This setting is included in the wallet provider metadata retrieved by wallet apps from /ssi/wallet-provider/v1/{walletProvider}, allowing wallets to behave according to your policy.

Wallet App Attestation (WAA)

WAAs verify the integrity and authenticity of the wallet application.

Required fields:

walletAppAttestation:
  expirationTime: 86400             # Attestation validity in seconds
  integrityCheck:
    enabled: false                  # Set to true to enable platform verification

Integrity check

The integrityCheck block is required and integrity check is enabled by default. To disable integrity check, set walletAppAttestation.integrityCheck.enabled: false.

walletAppAttestation:
  expirationTime: 86400
  integrityCheck:
    enabled: true
    android:
      bundleId: com.example.wallet
      signingCertificateFingerprints:
        - "FA:C6:17:..."
        - "G9:45:B1:..."
      trustedAttestationCAs:
        - "-----BEGIN CERTIFICATE-----\n..."
    ios:
      bundleId: com.example.wallet
      trustedAttestationCAs:
        - "-----BEGIN CERTIFICATE-----\n..."
      enforceProductionBuild: true   # Excludes debug / development builds

When enabled, the system validates:

• Certificate changes against trusted platform certificate authorities
• App bundle identifiers match configured values
• (iOS) Apps are production builds if enforceProductionBuild is true

Wallet unit attestation

Wallet unit attestation verifies cryptographic keys generated by wallet instances.

Required fields:

walletUnitAttestation:
  expirationTime: 2678400          # Attestation validity in seconds

Revocation support

To enable attestation revocation:

walletUnitAttestation:
  expirationTime: 2678400
  revocationMethod: TOKENSTATUSLIST  # Must match the name of a revocation provider with type `TOKENSTATUSLIST`

Without a revocation method configured, unit attestations cannot be revoked and are valid until they expire.

Optional configurations

EUDI Wallet metadata

Include general_info according to EUDI Wallet technical specifications:

eudiWalletInfo:
  providerName: "Example Provider"
  solutionId: "EXAMPLE_PROVIDER"
  solutionVersion: "1"
  wscdType: HYBRID

App version requirements

Enforce minimum app versions and block specific releases:

appVersion:
  minimum: "v1.50.0"                     # Required minimum version. Earlier versions are blocked
  minimumRecommended: "v1.60.0"          # Recommended minimum version. End users are suggested to update the app
  reject:                                # Explicitly blocked versions. This is useful if, for example, a version has a known security issue
    - "v1.51.3"
    - "v1.51.4"
  updateScreen:
    link: "https://example.com/update"   # URL for version update information

The wallet app retrieves this information from /ssi/wallet-provider/v1/{walletProvider} to enforce version requirements and recommendations.

Complete configuration example

Here's a fully configured wallet provider with all features enabled:

walletProvider:
  PROCIVIS_ONE:
    type: PROCIVIS_ONE
    display: walletProvider.procivisOne
    params:
      public:
        walletAppAttestation:
          walletName: "Example Wallet"
          walletLink: "https://example.com"
          integrityCheck:
            enabled: true
          expirationTime: 86400
          android:
            bundleId: com.example.wallet
            signingCertificateFingerprints:
              - "FA:C6:17:45:DC:50:D6:..."
            trustedAttestationCAs:
              - "-----BEGIN CERTIFICATE-----\n..."
          ios:
            bundleId: com.example.wallet
            trustedAttestationCAs:
              - "-----BEGIN CERTIFICATE-----\n..."
            enforceProductionBuild: true
        walletUnitAttestation:
          expirationTime: 2678400
          revocationMethod: TOKENSTATUSLIST
        eudiWalletInfo:
          # EUDI wallet metadata
        appVersion:
          minimum: "v1.50.0"
          minimumRecommended: "v1.60.0"
          reject:
            - "v1.51.3"
          updateScreen:
            link: "https://example.com/update"