Igrantio dcapi android

Skill L3-iGrant/skills/workflows/igrantio-dcapi-android

Agent Skills for EUDI Wallet and European Business Wallet integrations: credential issuance (OpenID4VCI), verification (OpenID4VP + DCQL), DC API and consent management on the iGrant.io Organisation Wallet Suite

Install

npx -y skills add L3-iGrant/skills --skill igrantio-dcapi-android

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

22 days oldThe repository was created 22 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Same-device and cross-device credential verification on Android via the W3C Digital Credentials API (browser invokes the wallet, no QR scan needed on same device) using OpenID4VP on the iGrant.io Organisation Wallet Suite. Presentation definition with responseMode dc_api (or signed with expectedOrigins), verification request v3 with requestByReference, navigator.credentials.get invocation from Chrome 141+, then verify vpTokenResponse and trust-list status. For EUDI Wallet (EUDIW) and European Business Wallet (EUBW) relying parties under eIDAS 2.0.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.5 KB, as published. Nobody here has run it

DC API verification on Android

When to use

Verify a credential in the browser on Android without a QR scan on the same device: the page calls the W3C Digital Credentials API and Chrome invokes the wallet. Cross-device still works (Chrome shows a QR; Bluetooth must be on for the proximity check).

Before you build: run the integrator intake in igrantio-ows-overview - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each.

Prerequisites

Chrome 141+ (or 128+ with chrome://flags#web-identity-digital-credentials).
The credential in the user's Data Wallet.
Bluetooth on both devices for cross-device.

Workflow

Presentation definition - protocol OpenID4VP, format IETF SD-JWT, responseMode: "dc_api". For the signed variant (openid4vp-v1-signed) also set expectedOrigins to your page origin (replay protection).
Verification request (v3) - requestByReference: true with the presentationDefinitionId. The response's verificationHistory.dcApiRequest + dcApiProtocol are the browser payload.
Invoke the wallet - navigator.credentials.get({ digital: ... }) with the backend-provided request object. Use the ready-made dcApi.ts helpers in igrantio-verifier-frontend (supportsDcApi, invokeWallet, buildReceivePayload) - they handle the Chrome request formats and the plain-vs-signed response shapes.
Post the response back through your backend proxy on an allow-listed receive path; the SSE stream still delivers the final result.
Verify - read verification history (v3): decode vpTokenResponse, check verified, isVerifiedWithTrustList, and trustServiceProvider.

Adjust for your deployment

Choose plain dc_api vs signed per your threat model; signed requires expectedOrigins to exactly match the serving origin(s).
Feature-detect and fall back to the QR flow (igrantio-verifier-frontend) when the DC API is unavailable.
Credential format and DCQL query are yours to set - compose with any igrantio-dcql-* workflow skill.

Cross-references

igrantio-dcapi-ios - the iOS variant (ISO 18013-7 Annex C, always signed).
igrantio-verifier-frontend - dcApi.ts reference implementation.

Source of truth

This workflow mirrors https://docs.igrant.io/docs/openID4vc-send-verify-credentials-dcapi-android/. Before implementing, fetch that page; if it disagrees with this skill (browser versions, response modes, endpoints), the documentation wins - follow it and report the drift so the skill can be updated.