Introducing OpenEUDI: An Open-Source SDK for EU Digital Identity Verification

Updated 20 October 2026: OpenEUDI moved from the MIT license to Apache-2.0 on 1 April 2026, shortly after this post was published, so the license references now say Apache-2.0. The code sample now matches the published @openeudi/core API (result.ageVerified, not ageOver18). The SDK is no longer in development: it has been on npm since 11 April 2026 (now @openeudi/core 0.8.0, @openeudi/openid4vp 0.13.0 and @openeudi/dcql 0.2.0), so the release roadmap is replaced with the current status. We also corrected the package list and the WooCommerce plugin's license (GPL v2 or later), and removed a TEST mode, a reference server and a compliance-mapping file that are not published.

Why We're Open-Sourcing the Protocol Layer

The EU Digital Identity Wallet is coming. By December 2026, every EU member state must issue EUDI Wallets to their citizens under Regulation (EU) 2024/1183. Businesses that verify customer identities — from age-restricted e-commerce to financial KYC — will need to speak the OpenID4VP protocol to communicate with these wallets.

But here's the problem: there is no production-ready, open-source verification library for the Relying Party side.

The European Commission published a reference wallet app (the holder/citizen side), but not a reference implementation for businesses that need to verify credentials. Existing SSI toolkits like walt.id (Kotlin/JVM) and SpruceID (Rust) target generic use cases, not the specific EUDI Wallet Architecture Reference Framework.

We've been building eIDAS Pro — a managed identity verification platform — for the past year. During that work, we built a TypeScript implementation of the OpenID4VP verification protocol. Today, we're extracting that protocol layer and releasing it as OpenEUDI: a free, Apache-2.0-licensed SDK that any developer can use.

What OpenEUDI Is

OpenEUDI is a TypeScript library that handles the technical complexity of verifying EU Digital Identity Wallet credentials. It implements:

• OpenID4VP (Verifiable Presentations) — the protocol that EUDI Wallets use to share verified attributes
• SD-JWT VC verification — selective disclosure JSON Web Tokens for remote verification flows
• mdoc/mDL verification — CBOR-based mobile document format for proximity verification
• Issuer trust verification — certificate chain validation against the trust anchors you configure, for example from EU trusted lists
• QR code session management — generate QR codes, track session state, receive results as events

import { VerificationService, DemoMode, InMemorySessionStore, VerificationType } from '@openeudi/core';
import { generateQRCode } from '@openeudi/core/qr';

const service = new VerificationService({
  mode: new DemoMode(),
  store: new InMemorySessionStore(),
});

const session = await service.createSession({ type: VerificationType.AGE });

console.log(await generateQRCode(session.walletUrl)); // Display to user

service.on('session:verified', (_session, result) => {
  console.log(result.ageVerified); // true
});

What OpenEUDI Is Not

OpenEUDI is the protocol library, not the full production stack. To run live verifications against real EUDI Wallets (launching December 2026), you also need:

• A WRPAC certificate (Wallet Relying Party Access Certificate) from a qualified trust service provider
• Relying Party registration with a national authority
• Production infrastructure: rate limiting, monitoring, audit logging, SLA guarantees

That's what eIDAS Pro's managed service is built to provide; managed WRPAC follows once WRPACs can be obtained. The SDK handles the protocol; the managed service handles the infrastructure.

Think of it like PostgreSQL (free, open-source database engine) vs. a managed database service (hosted, monitored, backed up). Both have value. The open-source tool gets you started; the managed service gets you to production without operational overhead.

The Open Core Model

We believe the verification protocol should be open infrastructure — like HTTP libraries or TLS implementations. Everyone benefits when the protocol layer is transparent, auditable, and community-maintained.

Our business model is straightforward:

This means:

• Developers can build and test verification flows for free
• Businesses that want managed compliance pay for the infrastructure
• The ecosystem benefits from a shared, auditable protocol implementation
• Security researchers can inspect the code that handles identity verification

What's Included

Core SDK (@openeudi/core)

The protocol library itself: OpenID4VP request/response handling, credential verification and session management.

The OpenEUDI ecosystem consists of three packages: @openeudi/core handles verification session management, @openeudi/openid4vp provides credential parsing for SD-JWT VC and mDOC formats with cryptographic signature validation, and @openeudi/dcql validates and matches DCQL queries, the credential query language of OpenID4VP 1.0.

E-Commerce Plugins (eIDAS Pro)

eIDAS Pro builds its e-commerce integrations on the same verification flow. They connect to the eIDAS Pro API:

• WooCommerce plugin (GPL v2 or later) — age verification at checkout
• Shopify app — Checkout UI Extension for identity verification
• JavaScript widget — embeddable verification for any website

Development Modes

@openeudi/core ships two modes for development:

• DEMO: auto-completes after 3 seconds by default, for showcases
• MOCK: configurable responses for integration testing

Documentation

Each package's README covers installation, usage examples and the API.

Built in Luxembourg

OpenEUDI is developed in Luxembourg, at the heart of Europe's fintech ecosystem. Luxembourg's strategic focus on digital identity, fintech, and regulatory compliance — combined with programmes like Fit 4 Start, LHoFT, and the SNCI — makes it the ideal base for building pan-European identity infrastructure.

Getting Started

The SDK is published on npm under the Apache-2.0 license. You can:

1. Install it: npm install @openeudi/core (add @openeudi/openid4vp and @openeudi/dcql for credential parsing and DCQL)
2. Read the source on GitHub at https://github.com/openeudi
3. Try the live demo on our homepage to see the verification flow in action
4. Read the technical deep dive on how eIDAS verification works

Where It Stands (October 2026)

• 11 April 2026: first public release of @openeudi/core (0.1.0) on npm
• Today: @openeudi/core 0.8.0, @openeudi/openid4vp 0.13.0, @openeudi/dcql 0.2.0
• Next: a production-ready release aligned with the EUDI Wallet launch
• Ongoing: Community contributions, additional framework integrations, language bindings

We're building OpenEUDI in the open. If you're working on EUDI Wallet integration, identity verification, or EU regulatory compliance, we'd love to hear from you.

---

OpenEUDI is Apache-2.0-licensed and free forever. The eIDAS Pro managed service is built to provide production infrastructure, managed WRPAC certificates (once they can be obtained) and SLAs for businesses that need managed compliance.

Related Articles

OpenEUDI SDK Quickstart: Your First Verification in 5 Minutes

A step-by-step tutorial to install the OpenEUDI SDK, create a verification session, and handle the result — all in under 5 minutes using DEMO mode.

6 min read

Understanding OpenID4VP: The Protocol Behind EU Digital Identity Wallets

A technical deep dive into OpenID4VP — the verification protocol that EUDI Wallets use to share verified attributes with businesses. How it works, why it matters, and how OpenEUDI implements it.

12 min read