Open jogu opened 7 months ago
The implementers on last night's working group call indicated that they'd never used this 'no specific authorization_endpoint' option - they always used QR codes that were https urls or custom url schemes.
They did indicate that it's not always clear what custom URL scheme a wallet might react to and in some cases it was advantageous if the wallet's in-app qr code scanner was tolerant of different custom url schemes.
In the wallet invocation section ( https://openid.github.io/OpenID4VP/openid-4-verifiable-presentations-wg-draft.html#section-7 ) this is one of the options:
This isn't very clear. I think it means you treat the Authorization Endpoint as being an empty string and hence the QR code contains something like:
However if we want this option to be interoperable then we probably need to be more specific and explicitly say we mean that the Authorization Endpoint url is treated as an empty string in this case.