Technical whitepaper for Number Verification with Operator Token and Android TS.43 / OpenID4VP flows

[albertoramosmonagas]

Problem description
CAMARA Number Verification API 2.1 supports JWT Bearer with Operator Token as an authentication mode, but the NV repository does not document how an operatorToken is actually obtained or exchanged end-to-end. This leaves a gap for App developers and Aggregators (Channel Partners) implementing the flow on Android, specifically: how the OpenID4VP/Digital Credentials API is used to acquire the SD-JWT credential via TS.43, how it is JWE-encrypted for the Aggregator, and how the Aggregator subsequently performs the RFC 7523 JWT Bearer exchange with the CSP Auth Server to obtain a CAMARA access token.

Telefónica has produced a draft companion document ("CAMARA Number Verification — Operator Token Acquisition") that specifies this end-to-end flow in detail: roles, the two standardised interfaces (App↔Aggregator, Aggregator↔CSP), error handling, required Android permissions, security considerations, and the credential_authorization_jwt structure used for Aggregator onboarding/whitelisting. It does not modify or replace any normative requirement of NV 2.1 — it documents the missing acquisition step.

Expected action

• Review the draft document for technical accuracy and fit as a non-normative companion reference to NV 2.1.
• Decide whether/how to incorporate it as documentation in the NumberVerification repository (e.g. under documentation/), with the explicit understanding that it is informative, not normative, and does not alter the NV 2.1 spec.
• Confirm alignment with the ICM JWT Bearer flow as currently documented, since this companion spec depends directly on it.
• Target a first round of maintainer feedback (NV, Commonalities, ICM) within 2 weeks of this issue being opened; if no quorum of comments is reached by then, escalate at the next NI WG meeting rather than leaving the issue open indefinitely. Target merge or a redirection decision within 4 weeks.

Additional context

• This work is being developed to complement CAMARA with end-to-end context across TS.43, OpenID4VP, and the Android Digital Credentials API, which are outside CAMARA's own normative scope but necessary for implementers.
• It should be referenced against the GSMA Authentication Taskforce Blueprint, a document currently being elaborated with multiple operators in the GSMA Authentication Taskforce, which covers related ground on the decline of SMS OTP as an authentication mechanism and the broader authentication ecosystem direction. That document is restricted to GSMA members and is not publicly linkable here; relevant GSMA stakeholders in cc can cross-reference it directly.

Important framing

• This whitepaper is complementary documentation, not a normative CAMARA API specification.
• It should not create new API requirements for Number Verification.
• It should not change the current Number Verification API scope.
• It may help developers understand how Number Verification fits into broader authentication architectures involving Operator Token, TS.43, OpenID4VP and Android.

cc: @camaraproject/number-verification_codeowners, @camaraproject/commonalities_codeowners, @camaraproject/identity-and-consent-management_codeowners, @camaraproject/marketing_codeowners (if we consider it relevant to publish it on the web), @hdamker

[bigludo7]

Thanks @albertoramosmonagas
This is excellent. We have done same in Orange and distribute it to several partners. Happy to contribute/review.