Authorization code flow

Use this when the claims must come from an authenticated user at your identity provider instead of from your request body. LutraID acts as the authorization server; the holder signs in before the wallet may fetch the credential.

POST/issuers/{issuerId}/create-authorization-code-offer

Create an offer

Editions: SaaS · Self-hosted · Public

curl "$LUTRAID_API/v1/organizations/$ORG/issuers/$ISSUER/create-authorization-code-offer" \
  -H "X-API-Key: $LUTRAID_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "issuanceProfileId": "8f1b…", "credentialOfferMode": "auto" }'

{
  "credentialOffer": "openid-credential-offer://?credential_offer_uri=https%3A%2F%2F…"
}

No data — the claims are resolved at login time from the upstream provider configured on the issuance profile.

The response carries only credentialOffer. There is no credentialOfferId, so this flow has no per-offer status lookup.

Which flow to pick

	Pre-authorized code	Authorization code
Claims come from	your request body	the holder's login
Holder proves identity	transaction code, out of band	at your IdP
Status endpoint	yes	no

What LutraID handles

Pushed authorization requests, the authorize and callback endpoints, PKCE, and the exchange with the upstream OIDC provider all run inside LutraID. Your only call is the one above.

The endpoint is tagged as public integration API on the public edition but not in the SaaS OpenAPI document, even though it works on both — check /doc on your own deployment before relying on generated clients.