CodeB Sovereign Communications
EU Wallet · Network Access via PID

One wallet tap. Any network.

Signed WiFi, WPA2/3-Enterprise, Hotspot 2.0, eSIM, APN and VPN profiles issued from EU Digital Identity Wallet presentations. Guest onboarding stops being a QR-hunt and a captive portal — it becomes one wallet tap that proves who you are, then hands you a signed network configuration that expires when your stay ends. Built on published EUDI, OpenID4VP and WPA-Enterprise standards. No captive portal. No shared passwords floating on Post-It notes.

Spec first · roadmap-honest

What ships today, what ships next

Today: the verifier accepts scope=network_access at /oidc.ashx?action=vp-start, preserves it across the presentation session, and the wire format is documented in /openapi.json so wallets can build against it. Next (Q3 2026): the tenant policy engine and signed NetworkConfig issuance ship as a per-tenant rollout — hotels first (Hostaway plugin already ships guest identity + WiFi capacity), then transport hubs and corporate BYOD. This page is the roadmap and the wire spec so wallet vendors, tenants and integrators can plan against it. Nothing here is marketed as shipped ahead of ship.

The flow

1 Guest scans venue WiFi QR
→
2 Wallet opens, shows credential picker
→
3 PID presented via OID4VP
→
4 Tenant policy check
→
5 Signed WiFi/APN/VPN config issued
→
6 Device auto-connects · expiry set

The wallet never sees a shared password. The venue never handles credentials in cleartext. The RADIUS identity is derived from the PID claims per tenant policy — typically given_name.family_name@tenant.example. Expiry is signed into the profile; when your stay ends, the device drops.

What’s in the signed configuration

{
  "profile_id":         "guest-wifi-hotel-cala-galdana",
  "network_type":       "wifi-wpa2-eap",
  "ssid":               "Hotel-Cala-Galdana-Guest",
  "eap_method":         "PEAP",
  "identity":           "anna.mueller@hotel-cala-galdana.example",
  "password_or_psk":    "<ephemeral, one-time>",
  "ca_certificate_pem": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
  "expires_at":         "2026-07-24T11:00:00Z",
  "signature":          "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlD..."
}

The compact JWS (ES256, x5c chain to the tenant verifier certificate) is what the wallet uses to trust the profile. The tenant policy file decides how PID claims map to identity, EAP method, VLAN, expiry and network profile.

Where it clicks — sectors we’re building for

Hotels + short-lets

Signed guest WiFi profile at check-in via the Hostaway plugin. Expiry matches the reservation. No captive portal, no printed key.

Transport hubs

Airport transit WiFi, train and coach onboard WiFi, ferry terminals. PID unlocks profile scoped to the trip; expires when you disembark.

Cafes + restaurants

Age-gated guest WiFi where the wallet also proves 18+ (piggybacks on our age-verify attestation flow).

Coworking + hot-desking

Membership check via the same PID + subscription attestation; VLAN assignment by membership tier.

Universities

Eduroam alternative for student WiFi with country/institution-scoped identity. WPA3-EAP profiles per faculty.

Corporate BYOD

Employee brings their EU Wallet to onboard personal devices to guest VLAN with corporate MDM profile install. Signed VPN peer bundle for remote workers.

MVNO + eSIM

PID + KYC unlocks a signed eSIM profile bundle. Wallet installs the SIM directly. Regulatory KYC done once, per-country.

Public sector guest WiFi

City-hall, library and municipal WiFi with PID-verified age gate (no children on adult-content-filtered SSIDs), country allow-list, and audit trail per session.

Standards + specifications

Aloaha in-house, not a fork

Every protocol layer — SD-JWT VC parsing, JWS + KB-JWT verification, OpenID4VP request/response, DCQL, JWE ECDH-ES, x5c chain validation, StatusList revocation, OpenID Federation 1.0 — is written by the Aloaha Limited team. No eudi-lib-*, no third-party EUDI SDK anywhere in the dependency tree. Generic infrastructure libraries (JWT/JWS, HTTP, .NET BCL crypto primitives) are widely-used open-source components; the EUDI-protocol layer is 100% Aloaha-written. Built and maintained on Malta. That gives your CISO an auditable in-house EUDI stack under a single legal entity, on our own release cadence — not gated on a consortium’s next SDK version.

Status · 2026-07-19. Verifier accepts scope=network_access. Wire format published in /openapi.json. Tenant policy engine and signed NetworkConfig issuance are the Q3 2026 sprint. First pilot: hotel guest WiFi via the Hostaway plugin. Talk to us if you want to co-design a pilot for another sector.

Learn more