eIDAS is the EU regulation governing electronic identification and trust services — including the qualified website (QWAC) and seal (QSEAL) certificates that identify regulated third parties in open banking. It provides the pan-European identity and certificate framework that PSD2's access-to-account model relies on, so a bank can cryptographically verify which licensed provider is calling its APIs.
eIDAS
Statute European Union
eIDAS — the EU’s Electronic Identification, Authentication and Trust Services regulation — is the identity layer that European open banking quietly runs on. When a third party calls a bank’s PSD2 API, the bank has to know which licensed provider is on the other end; eIDAS provides the qualified certificates (QWAC for the transport, QSEAL for the seals) that answer that question cryptographically.
- Qualified certificates - eIDAS defines the trust services that issue the website-authentication and electronic-seal certificates open-banking providers present.
- The identity behind the auth stack - Where FAPI and mTLS are the mechanism, eIDAS certificates are the identity they carry — the difference between an anonymous TLS client and an accredited AISP or PISP.
- Being modernized (eIDAS 2.0) - The regulation is evolving toward EU Digital Identity Wallets, extending the same trust model to individuals.
eIDAS is a good reminder that open banking is as much an identity problem as an API problem. A machine-readable contract and a bank-grade auth handshake mean little if you cannot prove who is calling; eIDAS is the regulation that makes third-party identity a verifiable fact rather than a claim, and it is the trust anchor the European standards in my catalog lean on.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
Dynamic Client Registration
Open-banking DCR requests carry eIDAS software statements/certificates to bind a registration to an accredited identity.
Mutual TLS
eIDAS QWAC certificates are what mutual-TLS presents to prove which licensed third party is connecting.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
tpp-signature-certificate
mandated
credentialed only
The certificate in this header is a QWAC issued under eIDAS. One header carrying the join between a payments regime and an identity regime.
