Soon every EU Member State must offer its citizens a digital identity wallet, and banks, telecoms, platforms and public services must accept it. Most of them have never discussed a credential protocol in their lives. EUDIPLO is the interpreter: open source, self-hosted middleware that turns one API call from your backend into a complete credential exchange with the wallet and hands back a clean JSON answer. Today we are excited to announce that EUDIPLO is joining LF Decentralized Trust (LFDT) as an incubating project.
EUDIPLO started in 2025 and grew up as a Growth project of the OpenWallet Foundation. Its move to LFDT brings a production-tested EUDI Wallet integration layer under vendor-neutral governance next to the foundation's other identity and trust projects. And it comes just at the moment when the European Union is turning the wallet from a plan into an obligation.
EUDIPLO is the diplomatic layer between an organization's backend and its users' wallets. It is a self-hosted issuer and verifier service: the backend talks to a JSON management API, wallets talk to EUDIPLO's protocol endpoints, and results come back through webhooks, server-sent events or polling. EUDIPLO is not a wallet and not an identity provider. It implements exactly the protocols of the EUDI Wallet ecosystem, so it stays interoperable with the reference wallets and uses one trust model.
EUDIPLO sits between the wallets and your infrastructure: wallets speak the EUDI protocols on one side, your systems speak HTTP and JSON on the other.
Standards based and conformance tested. EUDIPLO implements OpenID for Verifiable Credential Issuance 1.0 (OID4VCI), OpenID for Verifiable Presentations 1.0 (OID4VP) with DCQL, SD-JWT VC, ISO/IEC 18013-5 mdoc, ISO/IEC 18013-7 Annex C and the Digital Credentials API, the IETF Token Status List, and the OAuth building blocks the wallet ecosystem relies on: PAR, PKCE, DPoP and attestation-based client authentication. Every change runs against the OpenID Foundation conformance suite for OID4VCI and OID4VP.
Trust built in. EUDIPLO hosts and consumes ETSI TS 119 602 trust lists, resolves OpenID Federation trust chains, verifies wallet and key attestations, works with registrars for access and registration certificates, and publishes Token Status Lists for revocation and suspension.
Self hosted, with your keys. EUDIPLO is software you run, not a service you rent: one container with optional PostgreSQL, S3-compatible storage and an external key store. Signing keys can live in an HSM over PKCS#11, CSC API, AWS KMS or HashiCorp Vault and never leave it. Wallet responses are decrypted on your server and go straight to your backend. Nothing phones home.
Multi tenant and operable. One installation serves many tenants, each with its own keys, certificates, trust lists, configurations, API clients, and retention period. A Web Client lets teams configure credentials and verification requests and follow every session in the browser; a CLI installs, configures and operates an instance; and a TypeScript SDK wraps the API for integrators. Everything the Web Client does is also available through the API, so configuration can be managed as code.
The Web Client ships with EUDIPLO and runs next to it: configuration, operational health, and every session in the browser.
The EU has set the dates. Under eIDAS 2.0 (Regulation (EU) 2024/1183), every Member State must offer its citizens an EUDI Wallet, and banks, telecoms, transport, energy, health, education and very large online platforms must accept it when users choose to present it. Thousands of services that never implemented a credential protocol now have to become relying parties, and many will also issue credentials of their own.
Organizations facing that deadline have had a tough choice: patch together protocol libraries that may not exist for their stack or buy a proprietary solution that risks vendor lock-in and sends personal data through a third party. EUDIPLO is the third option. It communicates over HTTP and integrates with any backend language, so teams can focus on their business logic instead of cryptographic plumbing, and they do not have to rewrite anything when the specifications move.
Every step is a protocol detail your team does not build, does not test against the conformance suite, and does not rewrite when the specifications move. With a login in front, the authorization code flow adds pushed authorization requests, PKCE and the sign-in through Keycloak or any OpenID Connect provider.
Running in production. EUDIPLO powers the EUDI Wallet Playground, the German EUDI ecosystem's environment for testing wallets and their interoperability, and espuni, a multi-tenant age verification service for online platforms subject to Article 28 of the Digital Services Act. Romania's Ministry of Internal Affairs points attestation issuers to EUDIPLO in its RO Wallet Sandbox, the official test environment for integrating with the Romanian EUDI Wallet, as the open source way to issue, sign, and manage electronic attestations without implementing the European protocols themselves. Typical use cases are age verification ("over 18" and nothing else), customer onboarding from a Member State Personal ID, issuing employee IDs, student cards, memberships or tickets into the same wallet, and interoperability testing with real certificates, trust lists, and status lists.
Tested with real wallets. Issuance and presentation work with d-you, the German state EUDI Wallet that SPRIND is building for the Federal Ministry for Digital Affairs and State Modernisation, as well as with the EU Reference Implementation wallet, Animo's Paradym Wallet, Multipaz, and the EU age verification reference wallet, covering SD-JWT VC and mdoc, the Digital Credentials API and ISO 18013-7 Annex C. The wallet compatibility matrix is public and updated with every tested release.
EUDIPLO sits where the wallet ecosystem meets the organizations that have to use it: banks, public administrations, platforms, hosting providers and identity providers. Software in that position must belong to nobody in particular. LF Decentralized Trust gives EUDIPLO the structure to stay that way.
Vendor neutrality. EUDIPLO is governed by a technical charter and a Technical Steering Committee whose voting members are the project's maintainers. Decisions are made in public issues, pull requests and open community calls, and any contributor can become a maintainer by the approval of the existing ones. Organizations that build on EUDIPLO, or offer it as a service to their customers, get a dependable foundation that no single company can redirect.
A home among related projects. LFDT already hosts the building blocks of decentralized identity, from the Trust over IP governance frameworks to Hyperledger Identus, CREDEBL, AnonCreds and Hyperledger Indy. EUDIPLO adds the piece that the European regulation now demands: issuer and verifier infrastructure for the OpenID4VC and ISO mdoc stack the EUDI Wallet is built on. We look forward to sharing trust list, federation, and status list experience with projects that solve the same problems in other ecosystems.
Security and long-term stewardship. EUDIPLO already runs an OpenSSF Scorecard, static analysis, and the OpenID Foundation conformance suite on every change, and ships a signed-commit, DCO-covered history. Foundation stewardship adds a neutral security disclosure process, an open roadmap, and the assurance that the code will be maintained in public for as long as the ecosystem needs it.
Continuity with the OpenWallet Foundation. EUDIPLO grew up as a Growth project of the OpenWallet Foundation, where the wallet side of the EUDI ecosystem continues to develop. We are grateful for that start and will keep working closely with the wallet projects from that ecosystem: an issuer and verifier is only as useful as the wallets it talks to.
EUDIPLO ships a major release every few weeks, and its roadmap follows the ecosystem: the Architecture and Reference Framework, the implementing acts, and the wallet-provider and registrar requirements of the Member States. Contributions are especially welcome from relying parties with real integration needs, from wallet teams that want to add their wallet to the compatibility matrix, and from operators running EUDIPLO at scale.
The fastest way to see EUDIPLO is to run it. One command starts a demo with the backend and the Web Client, and the cookbook issues a membership credential to the wallet on your phone and verifies it in under an hour.
We invite relying parties, issuers, wallet providers, and service providers across Europe to explore EUDIPLO, bring their use cases, and help build the open infrastructure the EUDI Wallet ecosystem needs under the LF Decentralized Trust umbrella.