Skip to main content
OID4Pay
Talk to us

Trust

What OID4Pay is, and what it is not.

We would rather you know exactly what you are looking at. This page says it without marketing.

Ask us anything Security policy
A ceramics shop owner wraps a handmade mug at her wooden counter

It is

  • an authorisation and proof layer for agent payments
  • built on OAuth 2.0 and SD-JWT verifiable credentials
  • an append-only, hash-linked audit record
  • a set of verifier SDKs (MIT) and an MCP server (Apache-2.0), not published yet

It is not

  • a stored-value wallet: there is no balance
  • a card vault: the card stays with the payment processor
  • live with merchants yet: developer preview, test mode, no real money moves

Who stands behind it

01 / How it is protected

Three controls, in plain words.

Sender-constrained tokens

Access tokens are bound to the key of the agent that asked for them (DPoP). A stolen token alone does not work.

Signed at every step

The offer, the mandate, the proof of the key and the receipt are each signed. Only a fixed list of algorithms is accepted.

Append-only audit record

Every event is added to a hash-linked chain. Changing an old entry breaks every later link.

02 / More

Read the detail.

Security policy

How to report a problem, and what we do when you do.

Report a problem