From aba038f5c55294dcd40542c66725b2a7637b0f54 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:26:19 +0000
Subject: [PATCH 1/8] Initial plan


From 5eb6f200970f6942e1d39604a562b72b724dca7e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:34:45 +0000
Subject: [PATCH 2/8] Add OpenID4VCI authorization endpoint configuration

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 auth/api/iam/api.go      | 31 ++++++++++++++++++++++----
 auth/api/iam/api_test.go | 47 ++++++++++++++++++++++++++++++++++------
 auth/auth.go             |  7 +++++-
 auth/cmd/cmd.go          | 11 +++++++---
 auth/config.go           | 30 ++++++++++++++++---------
 auth/interface.go        |  4 +++-
 auth/mock.go             | 14 ++++++++++++
 7 files changed, 118 insertions(+), 26 deletions(-)

diff --git a/auth/api/iam/api.go b/auth/api/iam/api.go
index c3affbcf97..52725ceb5a 100644
--- a/auth/api/iam/api.go
+++ b/auth/api/iam/api.go
@@ -252,8 +252,9 @@ func (r Wrapper) HandleTokenRequest(ctx context.Context, request HandleTokenRequ
 }
 
 func (r Wrapper) Callback(ctx context.Context, request CallbackRequestObject) (CallbackResponseObject, error) {
-	if !r.auth.AuthorizationEndpointEnabled() {
-		// Callback endpoint is only used by flows initiated through the authorization endpoint.
+	// Callback endpoint is only used by flows initiated through the authorization endpoint.
+	// It's used by both OpenID4VP and OpenID4VCI flows
+	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
 		return nil, oauth.OAuth2Error{
 			Code:        oauth.InvalidRequest,
 			Description: "callback endpoint is disabled",
@@ -444,7 +445,8 @@ func (r Wrapper) introspectAccessToken(input string) (*ExtendedTokenIntrospectio
 
 // HandleAuthorizeRequest handles calls to the authorization endpoint for starting an authorization code flow.
 func (r Wrapper) HandleAuthorizeRequest(ctx context.Context, request HandleAuthorizeRequestRequestObject) (HandleAuthorizeRequestResponseObject, error) {
-	if !r.auth.AuthorizationEndpointEnabled() {
+	// Check if either OpenID4VP or OpenID4VCI authorization endpoint is enabled
+	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
 		return nil, oauth.OAuth2Error{
 			Code:        oauth.InvalidRequest,
 			Description: "authorization endpoint is disabled",
@@ -482,6 +484,16 @@ func (r Wrapper) handleAuthorizeRequest(ctx context.Context, subject string, own
 		// - Regular authorization code flow for EHR data access through access token, authentication of end-user using OpenID4VP.
 		// - OpenID4VCI; authorization code flow for credential issuance to (end-user) wallet
 
+		// Check if OpenID4VCI authorization endpoint is enabled for code flow
+		if !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+			redirectURI, _ := url.Parse(requestObject.get(oauth.RedirectURIParam))
+			return nil, oauth.OAuth2Error{
+				Code:        oauth.InvalidRequest,
+				Description: "authorization endpoint for OpenID4VCI is disabled",
+				RedirectURI: redirectURI,
+			}
+		}
+
 		// TODO: officially flow switching has to be determined by the client_id
 		// registered client_ids should list which flow they support
 		// client registration could be done via rfc7591....
@@ -490,6 +502,16 @@ func (r Wrapper) handleAuthorizeRequest(ctx context.Context, subject string, own
 	case oauth.VPTokenResponseType:
 		// Options:
 		// - OpenID4VP flow, vp_token is sent in Authorization Response
+		// Check if OpenID4VP authorization endpoint is enabled for vp_token flow
+		if !r.auth.AuthorizationEndpointEnabled() {
+			redirectURI, _ := url.Parse(requestObject.get(oauth.RedirectURIParam))
+			return nil, oauth.OAuth2Error{
+				Code:        oauth.InvalidRequest,
+				Description: "authorization endpoint for OpenID4VP is disabled",
+				RedirectURI: redirectURI,
+			}
+		}
+		
 		// non-spec: if the scheme is openid4vp (URL starts with openid4vp:), the OpenID4VP request should be handled by a user wallet, rather than an organization wallet.
 		//           Requests to user wallets can then be rendered as QR-code (or use a cloud wallet).
 		//           Note that it can't be called from the outside, but only by internal dispatch (since Echo doesn't handle openid4vp:, obviously).
@@ -616,7 +638,8 @@ func (r Wrapper) OAuthAuthorizationServerMetadata(_ context.Context, request OAu
 
 func (r Wrapper) oauthAuthorizationServerMetadata(clientID url.URL) (*oauth.AuthorizationServerMetadata, error) {
 	md := authorizationServerMetadata(&clientID, r.auth.SupportedDIDMethods())
-	if !r.auth.AuthorizationEndpointEnabled() {
+	// Remove authorization endpoint from metadata if both OpenID4VP and OpenID4VCI authorization endpoints are disabled
+	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
 		md.AuthorizationEndpoint = ""
 	}
 	return &md, nil
diff --git a/auth/api/iam/api_test.go b/auth/api/iam/api_test.go
index ed973f375f..5de4cab2a1 100644
--- a/auth/api/iam/api_test.go
+++ b/auth/api/iam/api_test.go
@@ -90,7 +90,7 @@ func TestWrapper_OAuthAuthorizationServerMetadata(t *testing.T) {
 		assert.NotEmpty(t, res.(OAuthAuthorizationServerMetadata200JSONResponse).AuthorizationEndpoint)
 	})
 	t.Run("authorization endpoint disabled", func(t *testing.T) {
-		ctx := newCustomTestClient(t, verifierURL, false)
+		ctx := newCustomTestClient(t, verifierURL, false, false)
 
 		res, err := ctx.client.OAuthAuthorizationServerMetadata(nil, OAuthAuthorizationServerMetadataRequestObject{SubjectID: verifierSubject})
 
@@ -101,7 +101,7 @@ func TestWrapper_OAuthAuthorizationServerMetadata(t *testing.T) {
 	t.Run("base URL (prepended before /iam)", func(t *testing.T) {
 		//	200
 		baseURL := test.MustParseURL("https://example.com/base")
-		ctx := newCustomTestClient(t, baseURL, false)
+		ctx := newCustomTestClient(t, baseURL, false, false)
 
 		res, err := ctx.client.OAuthAuthorizationServerMetadata(nil, OAuthAuthorizationServerMetadataRequestObject{SubjectID: verifierSubject})
 
@@ -250,13 +250,45 @@ func TestWrapper_PresentationDefinition(t *testing.T) {
 
 func TestWrapper_HandleAuthorizeRequest(t *testing.T) {
 	t.Run("disabled", func(t *testing.T) {
-		ctx := newCustomTestClient(t, verifierURL, false)
+		ctx := newCustomTestClient(t, verifierURL, false, false)
 
 		response, err := ctx.client.HandleAuthorizeRequest(nil, HandleAuthorizeRequestRequestObject{SubjectID: verifierSubject})
 
 		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint is disabled")
 		assert.Nil(t, response)
 	})
+	t.Run("OpenID4VCI disabled, response_type=code - should fail", func(t *testing.T) {
+		ctx := newCustomTestClient(t, verifierURL, true, false) // Only OpenID4VP enabled
+
+		// HandleAuthorizeRequest
+		requestParams := oauthParameters{
+			oauth.RedirectURIParam:  "https://example.com",
+			oauth.ResponseTypeParam: oauth.CodeResponseType,
+		}
+		ctx.jar.EXPECT().Parse(gomock.Any(), gomock.Any(), url.Values{"key": []string{"test_value"}}).Return(requestParams, nil)
+
+		res, err := ctx.client.HandleAuthorizeRequest(requestContext(map[string]interface{}{"key": "test_value"}),
+			HandleAuthorizeRequestRequestObject{SubjectID: verifierSubject})
+
+		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint for OpenID4VCI is disabled")
+		assert.Nil(t, res)
+	})
+	t.Run("OpenID4VP disabled, response_type=vp_token - should fail", func(t *testing.T) {
+		ctx := newCustomTestClient(t, verifierURL, false, true) // Only OpenID4VCI enabled
+
+		// HandleAuthorizeRequest
+		requestParams := oauthParameters{
+			oauth.RedirectURIParam:  "https://example.com",
+			oauth.ResponseTypeParam: oauth.VPTokenResponseType,
+		}
+		ctx.jar.EXPECT().Parse(gomock.Any(), gomock.Any(), url.Values{"key": []string{"test_value"}}).Return(requestParams, nil)
+
+		res, err := ctx.client.HandleAuthorizeRequest(requestContext(map[string]interface{}{"key": "test_value"}),
+			HandleAuthorizeRequestRequestObject{SubjectID: verifierSubject})
+
+		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint for OpenID4VP is disabled")
+		assert.Nil(t, res)
+	})
 	t.Run("ok - response_type=code", func(t *testing.T) {
 		ctx := newTestClient(t)
 
@@ -428,7 +460,7 @@ func TestWrapper_Callback(t *testing.T) {
 		TokenEndpoint: "https://example.com/token",
 	}
 	t.Run("disabled", func(t *testing.T) {
-		ctx := newCustomTestClient(t, verifierURL, false)
+		ctx := newCustomTestClient(t, verifierURL, false, false)
 
 		response, err := ctx.client.Callback(nil, CallbackRequestObject{SubjectID: holderSubjectID})
 
@@ -1579,10 +1611,10 @@ type testCtx struct {
 
 func newTestClient(t testing.TB) *testCtx {
 	publicURL, _ := url.Parse("https://example.com")
-	return newCustomTestClient(t, publicURL, true)
+	return newCustomTestClient(t, publicURL, true, true)
 }
 
-func newCustomTestClient(t testing.TB, publicURL *url.URL, authEndpointEnabled bool) *testCtx {
+func newCustomTestClient(t testing.TB, publicURL *url.URL, openid4vpEnabled bool, openid4vciEnabled bool) *testCtx {
 	ctrl := gomock.NewController(t)
 	storageEngine := storage.NewTestStorageEngine(t)
 	authnServices := auth.NewMockAuthenticationServices(ctrl)
@@ -1607,7 +1639,8 @@ func newCustomTestClient(t testing.TB, publicURL *url.URL, authEndpointEnabled b
 	mockVCR.EXPECT().Verifier().Return(vcVerifier).AnyTimes()
 	mockVCR.EXPECT().Wallet().Return(mockWallet).AnyTimes()
 	authnServices.EXPECT().IAMClient().Return(iamClient).AnyTimes()
-	authnServices.EXPECT().AuthorizationEndpointEnabled().Return(authEndpointEnabled).AnyTimes()
+	authnServices.EXPECT().AuthorizationEndpointEnabled().Return(openid4vpEnabled).AnyTimes()
+	authnServices.EXPECT().OpenID4VCIAuthorizationEndpointEnabled().Return(openid4vciEnabled).AnyTimes()
 
 	subjectManager.EXPECT().ListDIDs(gomock.Any(), holderSubjectID).Return([]did.DID{holderDID}, nil).AnyTimes()
 	subjectManager.EXPECT().ListDIDs(gomock.Any(), unknownSubjectID).Return(nil, didsubject.ErrSubjectNotFound).AnyTimes()
diff --git a/auth/auth.go b/auth/auth.go
index f135335c01..227c9bebfb 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -88,11 +88,16 @@ func (auth *Auth) PublicURL() *url.URL {
 	return auth.publicURL
 }
 
-// AuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled.
+// AuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VP flows.
 func (auth *Auth) AuthorizationEndpointEnabled() bool {
 	return auth.config.AuthorizationEndpoint.Enabled
 }
 
+// OpenID4VCIAuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
+func (auth *Auth) OpenID4VCIAuthorizationEndpointEnabled() bool {
+	return auth.config.OpenID4VCIAuthorizationEndpoint.Enabled
+}
+
 // ContractNotary returns an implementation of the ContractNotary interface.
 func (auth *Auth) ContractNotary() services.ContractNotary {
 	return auth.contractNotary
diff --git a/auth/cmd/cmd.go b/auth/cmd/cmd.go
index 5a2abf01e5..1ef89551c5 100644
--- a/auth/cmd/cmd.go
+++ b/auth/cmd/cmd.go
@@ -44,9 +44,12 @@ const ConfHTTPTimeout = "auth.http.timeout"
 // ConfAccessTokenLifeSpan defines how long (in seconds) an access token is valid
 const ConfAccessTokenLifeSpan = "auth.accesstokenlifespan"
 
-// ConfAuthEndpointEnabled is the config key for enabling the Auth v2 API's Authorization Endpoint
+// ConfAuthEndpointEnabled is the config key for enabling the Auth v2 API's Authorization Endpoint for OpenID4VP flows
 const ConfAuthEndpointEnabled = "auth.authorizationendpoint.enabled"
 
+// ConfOpenID4VCIAuthEndpointEnabled is the config key for enabling the Auth v2 API's Authorization Endpoint for OpenID4VCI flows
+const ConfOpenID4VCIAuthEndpointEnabled = "auth.openid4vci.enabled"
+
 // FlagSet returns the configuration flags supported by this module.
 func FlagSet() *pflag.FlagSet {
 	flags := pflag.NewFlagSet("auth", pflag.ContinueOnError)
@@ -59,8 +62,10 @@ func FlagSet() *pflag.FlagSet {
 	flags.Int(ConfClockSkew, defs.ClockSkew, "allowed JWT Clock skew in milliseconds")
 	flags.Int(ConfAccessTokenLifeSpan, defs.AccessTokenLifeSpan, "defines how long (in seconds) an access token is valid. Uses default in strict mode.")
 	flags.StringSlice(ConfContractValidators, defs.ContractValidators, "sets the different contract validators to use")
-	flags.Bool(ConfAuthEndpointEnabled, defs.AuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint, used by OpenID4VP and OpenID4VCI. "+
-		"This flag might be removed in a future version (or its default become 'true') as the use cases and implementation of OpenID4VP and OpenID4VCI mature.")
+	flags.Bool(ConfAuthEndpointEnabled, defs.AuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VP flows. "+
+		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VP matures.")
+	flags.Bool(ConfOpenID4VCIAuthEndpointEnabled, defs.OpenID4VCIAuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VCI flows. "+
+		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VCI matures.")
 	_ = flags.MarkDeprecated("auth.http.timeout", "use httpclient.timeout instead")
 
 	return flags
diff --git a/auth/config.go b/auth/config.go
index 0f30bd3c95..d6116db752 100644
--- a/auth/config.go
+++ b/auth/config.go
@@ -26,20 +26,30 @@ import (
 
 // Config holds all the configuration params
 type Config struct {
-	Irma                  IrmaConfig                  `koanf:"irma"`
-	HTTPTimeout           int                         `koanf:"http.timeout"`
-	ClockSkew             int                         `koanf:"clockskew"`
-	ContractValidators    []string                    `koanf:"contractvalidators"`
-	AccessTokenLifeSpan   int                         `koanf:"accesstokenlifespan"`
-	AuthorizationEndpoint AuthorizationEndpointConfig `koanf:"authorizationendpoint"`
+	Irma                             IrmaConfig                             `koanf:"irma"`
+	HTTPTimeout                      int                                    `koanf:"http.timeout"`
+	ClockSkew                        int                                    `koanf:"clockskew"`
+	ContractValidators               []string                               `koanf:"contractvalidators"`
+	AccessTokenLifeSpan              int                                    `koanf:"accesstokenlifespan"`
+	AuthorizationEndpoint            AuthorizationEndpointConfig            `koanf:"authorizationendpoint"`
+	OpenID4VCIAuthorizationEndpoint  OpenID4VCIAuthorizationEndpointConfig  `koanf:"openid4vci"`
 }
 
 type AuthorizationEndpointConfig struct {
-	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize), used for:
-	// - As OpenID4VP verifier: to authenticate clients (that initiate the Authorized Code flow) using OpenID4VP
+	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize) for OpenID4VP flows.
+	// This controls:
+	// - As OpenID4VP verifier: to authenticate clients using OpenID4VP
 	// - As OpenID4VP wallet: to authenticate verifiers using OpenID4VP
-	// - As OpenID4VCI wallet: to support dynamic credential requests (currently not supported)
-	// Disabling the authorization endpoint will also disable to callback endpoint and removes the endpoint from the metadata.
+	// Note: OpenID4VCI flows are controlled separately by OpenID4VCIAuthorizationEndpoint.Enabled
+	Enabled bool `koanf:"enabled"`
+}
+
+type OpenID4VCIAuthorizationEndpointConfig struct {
+	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize) for OpenID4VCI flows.
+	// This controls:
+	// - As OpenID4VCI wallet: to support authorization code flow for credential issuance
+	// When enabled, the authorization endpoint will accept response_type=code for OpenID4VCI flows.
+	// Disabling this will prevent OpenID4VCI authorization flows but will not affect the VCR OpenID4VCI issuer/wallet functionality.
 	Enabled bool `koanf:"enabled"`
 }
 
diff --git a/auth/interface.go b/auth/interface.go
index 6a0cd7eecb..b053ccef03 100644
--- a/auth/interface.go
+++ b/auth/interface.go
@@ -40,8 +40,10 @@ type AuthenticationServices interface {
 	ContractNotary() services.ContractNotary
 	// PublicURL returns the public URL of the node.
 	PublicURL() *url.URL
-	// AuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled.
+	// AuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VP flows.
 	AuthorizationEndpointEnabled() bool
+	// OpenID4VCIAuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
+	OpenID4VCIAuthorizationEndpointEnabled() bool
 	// SupportedDIDMethods lists the DID methods the Nuts node can resolve.
 	SupportedDIDMethods() []string
 }
diff --git a/auth/mock.go b/auth/mock.go
index e92db3f34a..55dec27364 100644
--- a/auth/mock.go
+++ b/auth/mock.go
@@ -99,6 +99,20 @@ func (mr *MockAuthenticationServicesMockRecorder) IAMClient() *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IAMClient", reflect.TypeOf((*MockAuthenticationServices)(nil).IAMClient))
 }
 
+// OpenID4VCIAuthorizationEndpointEnabled mocks base method.
+func (m *MockAuthenticationServices) OpenID4VCIAuthorizationEndpointEnabled() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "OpenID4VCIAuthorizationEndpointEnabled")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// OpenID4VCIAuthorizationEndpointEnabled indicates an expected call of OpenID4VCIAuthorizationEndpointEnabled.
+func (mr *MockAuthenticationServicesMockRecorder) OpenID4VCIAuthorizationEndpointEnabled() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenID4VCIAuthorizationEndpointEnabled", reflect.TypeOf((*MockAuthenticationServices)(nil).OpenID4VCIAuthorizationEndpointEnabled))
+}
+
 // PublicURL mocks base method.
 func (m *MockAuthenticationServices) PublicURL() *url.URL {
 	m.ctrl.T.Helper()

From 749d5a3728631c5a5e36d499bbf68ec63ccb2f16 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:37:16 +0000
Subject: [PATCH 3/8] Update generated documentation with new OpenID4VCI config

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 docs/pages/deployment/server_options.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/pages/deployment/server_options.rst b/docs/pages/deployment/server_options.rst
index a93ea21e31..bb98e665f6 100755
--- a/docs/pages/deployment/server_options.rst
+++ b/docs/pages/deployment/server_options.rst
@@ -16,7 +16,8 @@
     verbosity                                     info                                                                                                                                                                                                                                                                                                                                                                                                                                                                     Log level (trace, debug, info, warn, error)                                                                                                                                                                                                                                                                                                 
     httpclient.timeout                            30s                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Request time-out for HTTP clients, such as '10s'. Refer to Golang's 'time.Duration' syntax for a more elaborate description of the syntax.                                                                                                                                                                                                  
     **Auth**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
-    auth.authorizationendpoint.enabled            false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enables the v2 API's OAuth2 Authorization Endpoint, used by OpenID4VP and OpenID4VCI. This flag might be removed in a future version (or its default become 'true') as the use cases and implementation of OpenID4VP and OpenID4VCI mature.                                                                                                 
+    auth.authorizationendpoint.enabled            false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VP flows. This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VP matures.                                                                                                                                           
+    auth.openid4vci.enabled                       false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VCI flows. This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VCI matures.                                                                                                                                         
     **Crypto**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             
     crypto.storage                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Storage to use, 'fs' for file system (for development purposes), 'vaultkv' for HashiCorp Vault KV store, 'azure-keyvault' for Azure Key Vault, 'external' for an external backend (deprecated).                                                                                                                                             
     crypto.azurekv.hsm                            false                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Whether to store the key in a hardware security module (HSM). If true, the Azure Key Vault must be configured for HSM usage. Default: false                                                                                                                                                                                                 

From 1d52778a4403045ed9e10553bc73f9ea3682146c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:40:55 +0000
Subject: [PATCH 4/8] Fix authorization code flow to respect both configs

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 auth/api/iam/api.go      | 10 ++++++----
 auth/api/iam/api_test.go | 14 ++++----------
 2 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/auth/api/iam/api.go b/auth/api/iam/api.go
index 52725ceb5a..8cda28bf3e 100644
--- a/auth/api/iam/api.go
+++ b/auth/api/iam/api.go
@@ -484,12 +484,14 @@ func (r Wrapper) handleAuthorizeRequest(ctx context.Context, subject string, own
 		// - Regular authorization code flow for EHR data access through access token, authentication of end-user using OpenID4VP.
 		// - OpenID4VCI; authorization code flow for credential issuance to (end-user) wallet
 
-		// Check if OpenID4VCI authorization endpoint is enabled for code flow
-		if !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+		// Check if authorization endpoint is enabled for code flow.
+		// Since we can't distinguish between the two use cases at this point (see TODO below),
+		// we allow the request if either OpenID4VP or OpenID4VCI is enabled.
+		if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
 			redirectURI, _ := url.Parse(requestObject.get(oauth.RedirectURIParam))
 			return nil, oauth.OAuth2Error{
 				Code:        oauth.InvalidRequest,
-				Description: "authorization endpoint for OpenID4VCI is disabled",
+				Description: "authorization endpoint is disabled",
 				RedirectURI: redirectURI,
 			}
 		}
@@ -511,7 +513,7 @@ func (r Wrapper) handleAuthorizeRequest(ctx context.Context, subject string, own
 				RedirectURI: redirectURI,
 			}
 		}
-		
+
 		// non-spec: if the scheme is openid4vp (URL starts with openid4vp:), the OpenID4VP request should be handled by a user wallet, rather than an organization wallet.
 		//           Requests to user wallets can then be rendered as QR-code (or use a cloud wallet).
 		//           Note that it can't be called from the outside, but only by internal dispatch (since Echo doesn't handle openid4vp:, obviously).
diff --git a/auth/api/iam/api_test.go b/auth/api/iam/api_test.go
index 5de4cab2a1..8129398e23 100644
--- a/auth/api/iam/api_test.go
+++ b/auth/api/iam/api_test.go
@@ -257,20 +257,14 @@ func TestWrapper_HandleAuthorizeRequest(t *testing.T) {
 		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint is disabled")
 		assert.Nil(t, response)
 	})
-	t.Run("OpenID4VCI disabled, response_type=code - should fail", func(t *testing.T) {
-		ctx := newCustomTestClient(t, verifierURL, true, false) // Only OpenID4VP enabled
-
-		// HandleAuthorizeRequest
-		requestParams := oauthParameters{
-			oauth.RedirectURIParam:  "https://example.com",
-			oauth.ResponseTypeParam: oauth.CodeResponseType,
-		}
-		ctx.jar.EXPECT().Parse(gomock.Any(), gomock.Any(), url.Values{"key": []string{"test_value"}}).Return(requestParams, nil)
+	t.Run("OpenID4VCI and OpenID4VP disabled, response_type=code - should fail", func(t *testing.T) {
+		ctx := newCustomTestClient(t, verifierURL, false, false) // Both disabled
 
+		// This should fail at the outer check (before parsing) since both configs are disabled
 		res, err := ctx.client.HandleAuthorizeRequest(requestContext(map[string]interface{}{"key": "test_value"}),
 			HandleAuthorizeRequestRequestObject{SubjectID: verifierSubject})
 
-		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint for OpenID4VCI is disabled")
+		requireOAuthError(t, err, oauth.InvalidRequest, "authorization endpoint is disabled")
 		assert.Nil(t, res)
 	})
 	t.Run("OpenID4VP disabled, response_type=vp_token - should fail", func(t *testing.T) {

From b32bdee5236340a732e0f5eac2de12f6566a8a9a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:42:49 +0000
Subject: [PATCH 5/8] Fix remaining test failures

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 auth/api/auth/v1/api_test.go | 4 ++++
 auth/cmd/cmd_test.go         | 1 +
 2 files changed, 5 insertions(+)

diff --git a/auth/api/auth/v1/api_test.go b/auth/api/auth/v1/api_test.go
index 3310ad2ba9..535dbade85 100644
--- a/auth/api/auth/v1/api_test.go
+++ b/auth/api/auth/v1/api_test.go
@@ -74,6 +74,10 @@ func (m *mockAuthClient) AuthorizationEndpointEnabled() bool {
 	return true
 }
 
+func (m *mockAuthClient) OpenID4VCIAuthorizationEndpointEnabled() bool {
+	return true
+}
+
 func (m *mockAuthClient) AuthzServer() oauth.AuthorizationServer {
 	return m.authzServer
 }
diff --git a/auth/cmd/cmd_test.go b/auth/cmd/cmd_test.go
index 5fe44f4c19..e7b00c78f5 100644
--- a/auth/cmd/cmd_test.go
+++ b/auth/cmd/cmd_test.go
@@ -50,6 +50,7 @@ func TestFlagSet(t *testing.T) {
 		ConfAutoUpdateIrmaSchemas,
 		ConfIrmaCorsOrigin,
 		ConfIrmaSchemeManager,
+		ConfOpenID4VCIAuthEndpointEnabled,
 	}, keys)
 }
 

From 1e40835b0479d5af7cd33d1562e9a645cb77dc60 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:47:08 +0000
Subject: [PATCH 6/8] Complete OpenID4VCI configuration implementation

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 vcr/pe/schema/gen/go.mod |  4 +---
 vcr/pe/schema/gen/go.sum | 14 --------------
 2 files changed, 1 insertion(+), 17 deletions(-)

diff --git a/vcr/pe/schema/gen/go.mod b/vcr/pe/schema/gen/go.mod
index b872a8ae8e..05c918dc65 100644
--- a/vcr/pe/schema/gen/go.mod
+++ b/vcr/pe/schema/gen/go.mod
@@ -2,6 +2,4 @@ module github.com/nuts-foundation/nuts-node/vcr/pe/gen/schema
 
 go 1.21
 
-require (
-	github.com/a-h/generate v0.0.0-20220105161013-96c14dfdfb60 // indirect
-)
+require github.com/a-h/generate v0.0.0-20220105161013-96c14dfdfb60
diff --git a/vcr/pe/schema/gen/go.sum b/vcr/pe/schema/gen/go.sum
index 1f994a18a1..d5af305fbb 100644
--- a/vcr/pe/schema/gen/go.sum
+++ b/vcr/pe/schema/gen/go.sum
@@ -1,16 +1,2 @@
-github.com/PaesslerAG/gval v1.0.0 h1:GEKnRwkWDdf9dOmKcNrar9EA1bz1z9DqPIO1+iLzhd8=
-github.com/PaesslerAG/gval v1.0.0/go.mod h1:y/nm5yEyTeX6av0OfKJNp9rBNj2XrGhAf5+v24IBN1I=
-github.com/PaesslerAG/gval v1.2.2 h1:Y7iBzhgE09IGTt5QgGQ2IdaYYYOU134YGHBThD+wm9E=
-github.com/PaesslerAG/gval v1.2.2/go.mod h1:XRFLwvmkTEdYziLdaCeCa5ImcGVrfQbeNUbVR+C6xac=
-github.com/PaesslerAG/jsonpath v0.1.0/go.mod h1:4BzmtoM/PI8fPO4aQGIusjGxGir2BzcV0grWtFzq1Y8=
-github.com/PaesslerAG/jsonpath v0.1.1 h1:c1/AToHQMVsduPAa4Vh6xp2U0evy4t8SWp8imEsylIk=
-github.com/PaesslerAG/jsonpath v0.1.1/go.mod h1:lVboNxFGal/VwW6d9JzIy56bUsYAP6tH/x80vjnCseY=
-github.com/PaesslerAG/jsonpath v0.1.2-0.20230323094847-3484786d6f97 h1:XIsQOSBJi/9Bexr+rjUpuYi0IkQ+YqNKKlE7Yt/sw9Q=
-github.com/PaesslerAG/jsonpath v0.1.2-0.20230323094847-3484786d6f97/go.mod h1:zTyVtYhYjcHpfCtqnCMxejgp0pEEwb/xJzhn05NrkJk=
 github.com/a-h/generate v0.0.0-20220105161013-96c14dfdfb60 h1:/rNdG6EuzjwcR1KRFpF+9qWmWh2xIcz84QOeMGr/2L8=
 github.com/a-h/generate v0.0.0-20220105161013-96c14dfdfb60/go.mod h1:traiLYQ0YD7qUMCdjo6/jSaJRPHXniX4HVs+PhEhYpc=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
-github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

From 95788bf32640c4a8fc025bb05d8d2571ca5f66c8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 28 Jan 2026 16:54:58 +0000
Subject: [PATCH 7/8] Rename OpenID4VCIAuthorizationEndpoint to OpenID4VCI

Co-authored-by: reinkrul <1481228+reinkrul@users.noreply.github.com>
---
 auth/auth.go    |  2 +-
 auth/cmd/cmd.go |  2 +-
 auth/config.go  | 18 +++++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/auth/auth.go b/auth/auth.go
index 227c9bebfb..e4d959f3bd 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -95,7 +95,7 @@ func (auth *Auth) AuthorizationEndpointEnabled() bool {
 
 // OpenID4VCIAuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
 func (auth *Auth) OpenID4VCIAuthorizationEndpointEnabled() bool {
-	return auth.config.OpenID4VCIAuthorizationEndpoint.Enabled
+	return auth.config.OpenID4VCI.Enabled
 }
 
 // ContractNotary returns an implementation of the ContractNotary interface.
diff --git a/auth/cmd/cmd.go b/auth/cmd/cmd.go
index 1ef89551c5..db2427d8f4 100644
--- a/auth/cmd/cmd.go
+++ b/auth/cmd/cmd.go
@@ -64,7 +64,7 @@ func FlagSet() *pflag.FlagSet {
 	flags.StringSlice(ConfContractValidators, defs.ContractValidators, "sets the different contract validators to use")
 	flags.Bool(ConfAuthEndpointEnabled, defs.AuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VP flows. "+
 		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VP matures.")
-	flags.Bool(ConfOpenID4VCIAuthEndpointEnabled, defs.OpenID4VCIAuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VCI flows. "+
+	flags.Bool(ConfOpenID4VCIAuthEndpointEnabled, defs.OpenID4VCI.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VCI flows. "+
 		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VCI matures.")
 	_ = flags.MarkDeprecated("auth.http.timeout", "use httpclient.timeout instead")
 
diff --git a/auth/config.go b/auth/config.go
index d6116db752..7408a475f9 100644
--- a/auth/config.go
+++ b/auth/config.go
@@ -26,13 +26,13 @@ import (
 
 // Config holds all the configuration params
 type Config struct {
-	Irma                             IrmaConfig                             `koanf:"irma"`
-	HTTPTimeout                      int                                    `koanf:"http.timeout"`
-	ClockSkew                        int                                    `koanf:"clockskew"`
-	ContractValidators               []string                               `koanf:"contractvalidators"`
-	AccessTokenLifeSpan              int                                    `koanf:"accesstokenlifespan"`
-	AuthorizationEndpoint            AuthorizationEndpointConfig            `koanf:"authorizationendpoint"`
-	OpenID4VCIAuthorizationEndpoint  OpenID4VCIAuthorizationEndpointConfig  `koanf:"openid4vci"`
+	Irma                  IrmaConfig                  `koanf:"irma"`
+	HTTPTimeout           int                         `koanf:"http.timeout"`
+	ClockSkew             int                         `koanf:"clockskew"`
+	ContractValidators    []string                    `koanf:"contractvalidators"`
+	AccessTokenLifeSpan   int                         `koanf:"accesstokenlifespan"`
+	AuthorizationEndpoint AuthorizationEndpointConfig `koanf:"authorizationendpoint"`
+	OpenID4VCI            OpenID4VCIConfig            `koanf:"openid4vci"`
 }
 
 type AuthorizationEndpointConfig struct {
@@ -40,11 +40,11 @@ type AuthorizationEndpointConfig struct {
 	// This controls:
 	// - As OpenID4VP verifier: to authenticate clients using OpenID4VP
 	// - As OpenID4VP wallet: to authenticate verifiers using OpenID4VP
-	// Note: OpenID4VCI flows are controlled separately by OpenID4VCIAuthorizationEndpoint.Enabled
+	// Note: OpenID4VCI flows are controlled separately by OpenID4VCI.Enabled
 	Enabled bool `koanf:"enabled"`
 }
 
-type OpenID4VCIAuthorizationEndpointConfig struct {
+type OpenID4VCIConfig struct {
 	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize) for OpenID4VCI flows.
 	// This controls:
 	// - As OpenID4VCI wallet: to support authorization code flow for credential issuance

From 45c328a0e7cd9f9393da45f47b9f434b0bc0f2d7 Mon Sep 17 00:00:00 2001
From: Rein Krul <info@reinkrul.nl>
Date: Thu, 29 Jan 2026 09:42:45 +0100
Subject: [PATCH 8/8] wip

---
 auth/api/auth/v1/api_test.go |  2 +-
 auth/api/iam/api.go          | 17 ++++++++++++-----
 auth/api/iam/api_test.go     |  2 +-
 auth/auth.go                 |  4 ++--
 auth/cmd/cmd.go              | 13 +++++++------
 auth/cmd/cmd_test.go         |  2 +-
 auth/config.go               | 29 ++++++++++++-----------------
 auth/interface.go            | 11 ++++++-----
 auth/mock.go                 | 12 ++++++------
 9 files changed, 48 insertions(+), 44 deletions(-)

diff --git a/auth/api/auth/v1/api_test.go b/auth/api/auth/v1/api_test.go
index 535dbade85..17354201fe 100644
--- a/auth/api/auth/v1/api_test.go
+++ b/auth/api/auth/v1/api_test.go
@@ -74,7 +74,7 @@ func (m *mockAuthClient) AuthorizationEndpointEnabled() bool {
 	return true
 }
 
-func (m *mockAuthClient) OpenID4VCIAuthorizationEndpointEnabled() bool {
+func (m *mockAuthClient) OpenID4VCIEnabled() bool {
 	return true
 }
 
diff --git a/auth/api/iam/api.go b/auth/api/iam/api.go
index 8cda28bf3e..1ad04fd1eb 100644
--- a/auth/api/iam/api.go
+++ b/auth/api/iam/api.go
@@ -29,7 +29,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/nuts-foundation/nuts-node/core/to"
 	"html/template"
 	"net/http"
 	"net/url"
@@ -37,6 +36,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/nuts-foundation/nuts-node/core/to"
+
 	"github.com/labstack/echo/v4"
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/lestrrat-go/jwx/v2/jwt"
@@ -254,7 +255,7 @@ func (r Wrapper) HandleTokenRequest(ctx context.Context, request HandleTokenRequ
 func (r Wrapper) Callback(ctx context.Context, request CallbackRequestObject) (CallbackResponseObject, error) {
 	// Callback endpoint is only used by flows initiated through the authorization endpoint.
 	// It's used by both OpenID4VP and OpenID4VCI flows
-	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+	if !r.auth.OpenID4VPEnabled() && !r.auth.OpenID4VCIEnabled() {
 		return nil, oauth.OAuth2Error{
 			Code:        oauth.InvalidRequest,
 			Description: "callback endpoint is disabled",
@@ -298,8 +299,14 @@ func (r Wrapper) Callback(ctx context.Context, request CallbackRequestObject) (C
 	// continue flow
 	switch oauthSession.ClientFlow {
 	case credentialRequestClientFlow:
+		if !r.auth.OpenID4VCIEnabled() {
+			return nil, withCallbackURI(oauthError(oauth.InvalidRequest, "openid4vci is disabled"), oauthSession.redirectURI())
+		}
 		return r.handleOpenID4VCICallback(ctx, *request.Params.Code, oauthSession)
 	case accessTokenRequestClientFlow:
+		if !r.auth.OpenID4VPEnabled() {
+			return nil, withCallbackURI(oauthError(oauth.InvalidRequest, "openid4vp is disabled"), oauthSession.redirectURI())
+		}
 		return r.handleCallback(ctx, *request.Params.Code, oauthSession)
 	default:
 		// programming error, should never happen
@@ -446,7 +453,7 @@ func (r Wrapper) introspectAccessToken(input string) (*ExtendedTokenIntrospectio
 // HandleAuthorizeRequest handles calls to the authorization endpoint for starting an authorization code flow.
 func (r Wrapper) HandleAuthorizeRequest(ctx context.Context, request HandleAuthorizeRequestRequestObject) (HandleAuthorizeRequestResponseObject, error) {
 	// Check if either OpenID4VP or OpenID4VCI authorization endpoint is enabled
-	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+	if !r.auth.OpenID4VPEnabled() && !r.auth.OpenID4VCIEnabled() {
 		return nil, oauth.OAuth2Error{
 			Code:        oauth.InvalidRequest,
 			Description: "authorization endpoint is disabled",
@@ -487,7 +494,7 @@ func (r Wrapper) handleAuthorizeRequest(ctx context.Context, subject string, own
 		// Check if authorization endpoint is enabled for code flow.
 		// Since we can't distinguish between the two use cases at this point (see TODO below),
 		// we allow the request if either OpenID4VP or OpenID4VCI is enabled.
-		if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+		if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIEnabled() {
 			redirectURI, _ := url.Parse(requestObject.get(oauth.RedirectURIParam))
 			return nil, oauth.OAuth2Error{
 				Code:        oauth.InvalidRequest,
@@ -641,7 +648,7 @@ func (r Wrapper) OAuthAuthorizationServerMetadata(_ context.Context, request OAu
 func (r Wrapper) oauthAuthorizationServerMetadata(clientID url.URL) (*oauth.AuthorizationServerMetadata, error) {
 	md := authorizationServerMetadata(&clientID, r.auth.SupportedDIDMethods())
 	// Remove authorization endpoint from metadata if both OpenID4VP and OpenID4VCI authorization endpoints are disabled
-	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIAuthorizationEndpointEnabled() {
+	if !r.auth.AuthorizationEndpointEnabled() && !r.auth.OpenID4VCIEnabled() {
 		md.AuthorizationEndpoint = ""
 	}
 	return &md, nil
diff --git a/auth/api/iam/api_test.go b/auth/api/iam/api_test.go
index 8129398e23..034ece69dc 100644
--- a/auth/api/iam/api_test.go
+++ b/auth/api/iam/api_test.go
@@ -1634,7 +1634,7 @@ func newCustomTestClient(t testing.TB, publicURL *url.URL, openid4vpEnabled bool
 	mockVCR.EXPECT().Wallet().Return(mockWallet).AnyTimes()
 	authnServices.EXPECT().IAMClient().Return(iamClient).AnyTimes()
 	authnServices.EXPECT().AuthorizationEndpointEnabled().Return(openid4vpEnabled).AnyTimes()
-	authnServices.EXPECT().OpenID4VCIAuthorizationEndpointEnabled().Return(openid4vciEnabled).AnyTimes()
+	authnServices.EXPECT().OpenID4VCIEnabled().Return(openid4vciEnabled).AnyTimes()
 
 	subjectManager.EXPECT().ListDIDs(gomock.Any(), holderSubjectID).Return([]did.DID{holderDID}, nil).AnyTimes()
 	subjectManager.EXPECT().ListDIDs(gomock.Any(), unknownSubjectID).Return(nil, didsubject.ErrSubjectNotFound).AnyTimes()
diff --git a/auth/auth.go b/auth/auth.go
index e4d959f3bd..17eb08af69 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -93,8 +93,8 @@ func (auth *Auth) AuthorizationEndpointEnabled() bool {
 	return auth.config.AuthorizationEndpoint.Enabled
 }
 
-// OpenID4VCIAuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
-func (auth *Auth) OpenID4VCIAuthorizationEndpointEnabled() bool {
+// OpenID4VCIEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
+func (auth *Auth) OpenID4VCIEnabled() bool {
 	return auth.config.OpenID4VCI.Enabled
 }
 
diff --git a/auth/cmd/cmd.go b/auth/cmd/cmd.go
index db2427d8f4..9e7a632bde 100644
--- a/auth/cmd/cmd.go
+++ b/auth/cmd/cmd.go
@@ -47,8 +47,11 @@ const ConfAccessTokenLifeSpan = "auth.accesstokenlifespan"
 // ConfAuthEndpointEnabled is the config key for enabling the Auth v2 API's Authorization Endpoint for OpenID4VP flows
 const ConfAuthEndpointEnabled = "auth.authorizationendpoint.enabled"
 
-// ConfOpenID4VCIAuthEndpointEnabled is the config key for enabling the Auth v2 API's Authorization Endpoint for OpenID4VCI flows
-const ConfOpenID4VCIAuthEndpointEnabled = "auth.openid4vci.enabled"
+// ConfOpenID4VCIEnabled is the config key for enabling OpenID4VCI.
+const ConfOpenID4VCIEnabled = "auth.openid4vci.enabled"
+
+// ConfOpenID4VPEnabled is the config key for enabling OpenID4VP.
+const ConfOpenID4VPEnabled = "auth.openid4vp.enabled"
 
 // FlagSet returns the configuration flags supported by this module.
 func FlagSet() *pflag.FlagSet {
@@ -62,10 +65,8 @@ func FlagSet() *pflag.FlagSet {
 	flags.Int(ConfClockSkew, defs.ClockSkew, "allowed JWT Clock skew in milliseconds")
 	flags.Int(ConfAccessTokenLifeSpan, defs.AccessTokenLifeSpan, "defines how long (in seconds) an access token is valid. Uses default in strict mode.")
 	flags.StringSlice(ConfContractValidators, defs.ContractValidators, "sets the different contract validators to use")
-	flags.Bool(ConfAuthEndpointEnabled, defs.AuthorizationEndpoint.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VP flows. "+
-		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VP matures.")
-	flags.Bool(ConfOpenID4VCIAuthEndpointEnabled, defs.OpenID4VCI.Enabled, "enables the v2 API's OAuth2 Authorization Endpoint for OpenID4VCI flows. "+
-		"This flag might be removed in a future version (or its default become 'true') as the implementation of OpenID4VCI matures.")
+	flags.Bool(ConfOpenID4VCIEnabled, defs.OpenID4VCI.Enabled, "enables OpenID4VCI (experimental) support, allowing credential issuance be requested for local wallets through OpenID4VCI.")
+	flags.Bool(ConfOpenID4VPEnabled, defs.OpenID4VP.Enabled, "enables OpenID4VCI (experimental) support, allowing; authentication of clients using OpenID4VP (as verifier) and responding to OpenID4VP requests from OpenID4VP verifiers (as wallet).")
 	_ = flags.MarkDeprecated("auth.http.timeout", "use httpclient.timeout instead")
 
 	return flags
diff --git a/auth/cmd/cmd_test.go b/auth/cmd/cmd_test.go
index e7b00c78f5..fc64509187 100644
--- a/auth/cmd/cmd_test.go
+++ b/auth/cmd/cmd_test.go
@@ -50,7 +50,7 @@ func TestFlagSet(t *testing.T) {
 		ConfAutoUpdateIrmaSchemas,
 		ConfIrmaCorsOrigin,
 		ConfIrmaSchemeManager,
-		ConfOpenID4VCIAuthEndpointEnabled,
+		ConfOpenID4VCIEnabled,
 	}, keys)
 }
 
diff --git a/auth/config.go b/auth/config.go
index 7408a475f9..648a5605f6 100644
--- a/auth/config.go
+++ b/auth/config.go
@@ -26,30 +26,25 @@ import (
 
 // Config holds all the configuration params
 type Config struct {
-	Irma                  IrmaConfig                  `koanf:"irma"`
-	HTTPTimeout           int                         `koanf:"http.timeout"`
-	ClockSkew             int                         `koanf:"clockskew"`
-	ContractValidators    []string                    `koanf:"contractvalidators"`
-	AccessTokenLifeSpan   int                         `koanf:"accesstokenlifespan"`
-	AuthorizationEndpoint AuthorizationEndpointConfig `koanf:"authorizationendpoint"`
-	OpenID4VCI            OpenID4VCIConfig            `koanf:"openid4vci"`
+	Irma                IrmaConfig       `koanf:"irma"`
+	HTTPTimeout         int              `koanf:"http.timeout"`
+	ClockSkew           int              `koanf:"clockskew"`
+	ContractValidators  []string         `koanf:"contractvalidators"`
+	AccessTokenLifeSpan int              `koanf:"accesstokenlifespan"`
+	OpenID4VCI          OpenID4VCIConfig `koanf:"openid4vci"`
+	OpenID4VP           OpenID4VPConfig  `koanf:"openid4vp"`
 }
 
-type AuthorizationEndpointConfig struct {
-	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize) for OpenID4VP flows.
-	// This controls:
+type OpenID4VPConfig struct {
+	// Enabled is a flag to enable or disable OpenID4VP support:
 	// - As OpenID4VP verifier: to authenticate clients using OpenID4VP
-	// - As OpenID4VP wallet: to authenticate verifiers using OpenID4VP
-	// Note: OpenID4VCI flows are controlled separately by OpenID4VCI.Enabled
+	// - As OpenID4VP wallet: to respond to OpenID4VP requests to from OpenID4VP verifiers.
 	Enabled bool `koanf:"enabled"`
 }
 
 type OpenID4VCIConfig struct {
-	// Enabled is a flag to enable or disable the v2 API's Authorization Endpoint (/authorize) for OpenID4VCI flows.
-	// This controls:
-	// - As OpenID4VCI wallet: to support authorization code flow for credential issuance
-	// When enabled, the authorization endpoint will accept response_type=code for OpenID4VCI flows.
-	// Disabling this will prevent OpenID4VCI authorization flows but will not affect the VCR OpenID4VCI issuer/wallet functionality.
+	// Enabled is a flag to enable OpenID4VCI support.
+	// If enabled, credential issuance can be requested for local wallets through OpenID4VCI.
 	Enabled bool `koanf:"enabled"`
 }
 
diff --git a/auth/interface.go b/auth/interface.go
index b053ccef03..4767ed7a4b 100644
--- a/auth/interface.go
+++ b/auth/interface.go
@@ -19,10 +19,11 @@
 package auth
 
 import (
+	"net/url"
+
 	"github.com/nuts-foundation/nuts-node/auth/client/iam"
 	"github.com/nuts-foundation/nuts-node/auth/services"
 	"github.com/nuts-foundation/nuts-node/auth/services/oauth"
-	"net/url"
 )
 
 // ModuleName contains the name of this module
@@ -40,10 +41,10 @@ type AuthenticationServices interface {
 	ContractNotary() services.ContractNotary
 	// PublicURL returns the public URL of the node.
 	PublicURL() *url.URL
-	// AuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VP flows.
-	AuthorizationEndpointEnabled() bool
-	// OpenID4VCIAuthorizationEndpointEnabled returns whether the v2 API's OAuth2 Authorization Endpoint is enabled for OpenID4VCI flows.
-	OpenID4VCIAuthorizationEndpointEnabled() bool
+	// OpenID4VCIEnabled returns whether OpenID4VCI is enabled.
+	OpenID4VCIEnabled() bool
+	// OpenID4VPEnabled returns whether OpenID4VP is enabled.
+	OpenID4VPEnabled() bool
 	// SupportedDIDMethods lists the DID methods the Nuts node can resolve.
 	SupportedDIDMethods() []string
 }
diff --git a/auth/mock.go b/auth/mock.go
index 55dec27364..27bf8dcde6 100644
--- a/auth/mock.go
+++ b/auth/mock.go
@@ -99,18 +99,18 @@ func (mr *MockAuthenticationServicesMockRecorder) IAMClient() *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IAMClient", reflect.TypeOf((*MockAuthenticationServices)(nil).IAMClient))
 }
 
-// OpenID4VCIAuthorizationEndpointEnabled mocks base method.
-func (m *MockAuthenticationServices) OpenID4VCIAuthorizationEndpointEnabled() bool {
+// OpenID4VCIEnabled mocks base method.
+func (m *MockAuthenticationServices) OpenID4VCIEnabled() bool {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "OpenID4VCIAuthorizationEndpointEnabled")
+	ret := m.ctrl.Call(m, "OpenID4VCIEnabled")
 	ret0, _ := ret[0].(bool)
 	return ret0
 }
 
-// OpenID4VCIAuthorizationEndpointEnabled indicates an expected call of OpenID4VCIAuthorizationEndpointEnabled.
-func (mr *MockAuthenticationServicesMockRecorder) OpenID4VCIAuthorizationEndpointEnabled() *gomock.Call {
+// OpenID4VCIEnabled indicates an expected call of OpenID4VCIEnabled.
+func (mr *MockAuthenticationServicesMockRecorder) OpenID4VCIEnabled() *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenID4VCIAuthorizationEndpointEnabled", reflect.TypeOf((*MockAuthenticationServices)(nil).OpenID4VCIAuthorizationEndpointEnabled))
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "OpenID4VCIEnabled", reflect.TypeOf((*MockAuthenticationServices)(nil).OpenID4VCIEnabled))
 }
 
 // PublicURL mocks base method.