From 6b8ed252d2de817e57294a93cf8fe3fd865beca6 Mon Sep 17 00:00:00 2001
From: Thomas Diesler <tdiesler@proton.me>
Date: Thu, 2 Jul 2026 15:48:03 +0200
Subject: [PATCH 1/2] [OID4VCI] Issuance with Authorization Code Flow assumes
 same client_id for offer creation and redemption

closes #48188

Signed-off-by: Thomas Diesler <tdiesler@proton.me>

* Stop binding authorization-code credential offers to the creating client (targetClientId = null for auth-code offers).
* Keep pre-authorized code offers bound to the authenticated client.
* Update Javadoc section headings to explicitly name the corresponding grant types.
---
 .../oid4vc/issuance/OID4VCIssuerEndpoint.java | 10 ++-
 .../oid4vc/CredentialOfferStateUtils.java     | 65 +++++++++++++++++++
 .../OID4VCredentialOfferAuthCodeTest.java     | 20 +++++-
 .../OID4VCredentialOfferPreAuthTest.java      | 24 ++++++-
 4 files changed, 112 insertions(+), 7 deletions(-)
 create mode 100644 tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java

diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
index f7ef9baf7f88..0377a7992f4c 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
@@ -429,7 +429,7 @@ public Response createCredentialOffer(String credConfigId, boolean preAuthorized
      * | yes      | yes      | yes     | Offer restricted to a specific user.       |
      * +----------+----------+---------+--------------------------------------------+
      * </p>
-     * <b>Pre-Authorized Offer</b>
+     * <b>Pre-Authorized Code Grant Offer</b>
      * <ul>
      *   <li>A pre-authorized offer is authorized for the clientId from the current login session</li>
      *   <li>If targetUser is null or empty, it defaults to the user from the current login session</li>
@@ -439,7 +439,7 @@ public Response createCredentialOffer(String credConfigId, boolean preAuthorized
      *   <li>An offer can optionally have a predefined expiry date</li>
      * </ul>
      *
-     * <b>Non Pre-Authorized Offer</b>
+     * <b>Authorization Code Grant Offer</b>
      * <ul>
      *   <li>If targetUser is null or empty, the generated offer is "anonymous"</li>
      *   <li>If targetUser is equal to the current login, the offer is "self issued"</li>
@@ -540,10 +540,14 @@ public Response createCredentialOffer(
 
         // Create the CredentialsOffer
         //
-        String targetClientId = clientModel.getClientId();
         String grantType = preAuthorized ? PRE_AUTH_GRANT_TYPE : AUTH_CODE_GRANT_TYPE;
         List<String> credentialConfigurationIds = List.of(credentialConfigurationId);
 
+        // Bind pre-authorized code offers to the authenticated client to prevent redemption from a different client_id.
+        // Authorization Code Grant offers are intentionally not bound to a client_id.
+        // https://github.com/keycloak/keycloak/issues/48188
+        String targetClientId = preAuthorized ? clientModel.getClientId() : null;
+
         CredentialOfferState offerState;
         try {
 
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java
new file mode 100644
index 000000000000..bc2b5be5e4fc
--- /dev/null
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/CredentialOfferStateUtils.java
@@ -0,0 +1,65 @@
+package org.keycloak.tests.oid4vc;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.keycloak.models.RealmModel;
+import org.keycloak.models.UserModel;
+import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferState;
+import org.keycloak.protocol.oid4vc.issuance.credentialoffer.CredentialOfferStorage;
+import org.keycloak.protocol.oid4vc.model.OID4VCAuthorizationDetail;
+import org.keycloak.testframework.remote.runonserver.RunOnServerClient;
+import org.keycloak.util.JsonSerialization;
+
+public final class CredentialOfferStateUtils {
+
+    private CredentialOfferStateUtils() {
+    }
+
+    public record CredentialOfferStateRecord(
+            String credentialsOfferId,
+            String targetUsername,
+            String targetClientId,
+            String txCode,
+            List<OID4VCAuthorizationDetail> authDetails
+    ) {}
+
+    public static CredentialOfferStateRecord getCredentialOfferStateRecord(RunOnServerClient runOnServer, String offerNonce) {
+        var runtimeOfferState = runOnServer.fetchString(session -> {
+
+            RealmModel realm = session.getContext().getRealm();
+            CredentialOfferStorage offerStorage = session.getProvider(CredentialOfferStorage.class);
+            CredentialOfferState offerState = Optional.ofNullable(offerStorage.getOfferStateByNonce(offerNonce))
+                    .orElseThrow(() -> new IllegalStateException("No CredentialOfferState for nonce: " + offerNonce));
+
+            UserModel userModel = null;
+            if (offerState.getTargetUserId() != null) {
+                String targetUserId = offerState.getTargetUserId();
+                userModel = session.users().getUserById(realm, targetUserId);
+                if (userModel == null) {
+                    throw new IllegalStateException("No User for id: " + targetUserId);
+                }
+            }
+
+            Map<String, Object> valueMap = new LinkedHashMap<>();
+            valueMap.put("credentialsOfferId", offerState.getCredentialsOfferId());
+
+            Optional.ofNullable(userModel)
+                    .ifPresent(it -> valueMap.put("targetUsername", it.getUsername()));
+
+            Optional.ofNullable(offerState.getTargetClientId())
+                    .ifPresent(it -> valueMap.put("targetClientId", it));
+
+            Optional.ofNullable(offerState.getAuthorizationDetails())
+                    .ifPresent(it -> valueMap.put("authDetails", it));
+
+            Optional.ofNullable(offerState.getTxCode())
+                    .ifPresent(it -> valueMap.put("txCode", it));
+
+            return JsonSerialization.valueAsString(valueMap);
+        });
+        return JsonSerialization.valueFromString(runtimeOfferState, CredentialOfferStateRecord.class);
+    }
+}
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
index 7978266a5a4e..c05a36ec1836 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
@@ -14,6 +14,7 @@
 import org.keycloak.sdjwt.IssuerSignedJWT;
 import org.keycloak.sdjwt.vp.SdJwtVP;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.oid4vc.CredentialOfferStateUtils.CredentialOfferStateRecord;
 import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.oauth.AuthorizationEndpointResponse;
 import org.keycloak.testsuite.util.oauth.oid4vc.CredentialOfferResponse;
@@ -26,10 +27,12 @@
 import static org.keycloak.OID4VCConstants.CLAIM_NAME_VCT;
 import static org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerEndpoint.DEFAULT_CREDENTIAL_OFFER_LIFESPAN_S;
 import static org.keycloak.protocol.oidc.OIDCLoginProtocol.PROMPT_VALUE_LOGIN;
+import static org.keycloak.tests.oid4vc.CredentialOfferStateUtils.getCredentialOfferStateRecord;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -66,6 +69,12 @@ public void testAuthCodeOffer_Anonymous() throws Exception {
         CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
         assertNotNull(offerURI, "No CredentialOfferURI");
 
+        // Verify internal offer state target user and client
+        //
+        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+        assertNull(runtimeOfferState.targetUsername(), "Expected null targetUsername");
+        assertNull(runtimeOfferState.targetClientId(), "Expected null targetClientId");
+
         // Fetch credential offer again
         // https://github.com/keycloak/keycloak/issues/48014
         credOffer = wallet.credentialsOfferRequest(ctx, offerURI).send().getCredentialsOffer();
@@ -80,7 +89,7 @@ public void testAuthCodeOffer_Anonymous() throws Exception {
         verifyCredentialResponse(ctx, ctx.getHolder(), credResponse);
 
         // Attempt to fetch the credential offer again after it has been consumed
-
+        //
         CredentialOfferResponse res = wallet.credentialsOfferRequest(ctx, offerURI).send();
         assertEquals("invalid_credential_offer_request", res.getError());
         assertEquals("Credential offer not found or already consumed", res.getErrorDescription());
@@ -239,6 +248,15 @@ public void testAuthCodeOffer_Targeted() throws Exception {
         String issuerState = credOffer.getIssuerState();
         assertNotNull(issuerState, "No IssuerState");
 
+        CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
+        assertNotNull(offerURI, "No CredentialOfferURI");
+
+        // Verify internal target user and client
+        //
+        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+        assertEquals("alice", runtimeOfferState.targetUsername());
+        assertNull(runtimeOfferState.targetClientId(), "targetClientId should be null");
+
         // Send AuthorizationRequest
         //
         AuthorizationEndpointResponse authResponse = wallet
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
index 30ad35dbb517..85196389cb42 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
@@ -14,6 +14,7 @@
 import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
+import org.keycloak.tests.oid4vc.CredentialOfferStateUtils.CredentialOfferStateRecord;
 import org.keycloak.tests.oid4vc.OID4VCIssuerTestBase;
 import org.keycloak.tests.oid4vc.OID4VCTestContext;
 import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
@@ -22,6 +23,8 @@
 
 import org.junit.jupiter.api.Test;
 
+import static org.keycloak.tests.oid4vc.CredentialOfferStateUtils.getCredentialOfferStateRecord;
+
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -117,6 +120,15 @@ public void testPreAuthOffer_SelfIssued() throws Exception {
 
         String preAuthCode = credOffer.getPreAuthorizedCode();
 
+        CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
+        assertNotNull(offerURI, "No CredentialOfferURI");
+
+        // Verify internal offer state target user and client
+        //
+        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+        assertEquals("john", runtimeOfferState.targetUsername());
+        assertEquals(client.getClientId(), runtimeOfferState.targetClientId());
+
         // Redeem Pre-Authorized Code for AccessToken
         //
         AccessTokenResponse tokenResponse = wallet.accessTokenRequestPreAuth(ctx, preAuthCode).send();
@@ -149,12 +161,18 @@ public void testPreAuthOffer_Targeted() throws Exception {
             req.preAuthorized(true);
         });
 
-        String preAuthCode = credOffer.getPreAuthorizedCode();
-        assertNotNull(preAuthCode, "preAuthCode");
-
         CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
         assertNotNull(offerURI, "No CredentialOfferURI");
 
+        // Verify internal offer state target user and client
+        //
+        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+        assertEquals("alice", runtimeOfferState.targetUsername());
+        assertEquals(client.getClientId(), runtimeOfferState.targetClientId());
+
+        String preAuthCode = credOffer.getPreAuthorizedCode();
+        assertNotNull(preAuthCode, "preAuthCode");
+
         // Fetch credential offer again
         // https://github.com/keycloak/keycloak/issues/48014
         credOffer = wallet.credentialsOfferRequest(ctx, offerURI).send().getCredentialsOffer();

From 9cea73c5cdad1d4abce46cc5528b3dfd19f929e3 Mon Sep 17 00:00:00 2001
From: Thomas Diesler <tdiesler@proton.me>
Date: Tue, 14 Jul 2026 16:17:03 +0200
Subject: [PATCH 2/2] [OID4VCI] Explicit client association for pre-authorized
 offers

closes #50587

Signed-off-by: Thomas Diesler <tdiesler@proton.me>

Decouples pre-authorized credential offers from the creating client by supporting explicit or uniquely discovered target clients.

* Adds target_client request support and client discovery.
* Updates pre-authorized issuance flows and tests.
* Adds offer-state inspection utilities.
---
 .../oid4vc/issuance/OID4VCIssuerEndpoint.java |  51 +--
 .../CredentialOfferProvider.java              |   2 +-
 .../DefaultCredentialOfferProvider.java       |  76 +++-
 .../VerifiableCredentialOfferAction.java      |   4 +-
 .../oid4vc/utils/CredentialScopeUtils.java    |  19 +-
 .../tests/oid4vc/OID4VCBasicWallet.java       |  63 ++-
 .../oid4vc/OID4VCCredentialOfferCorsTest.java |   7 +-
 .../tests/oid4vc/OID4VCIssuerTestBase.java    |  27 ++
 .../tests/oid4vc/OID4VCTestContext.java       |  35 +-
 .../OID4VCredentialOfferAuthCodeTest.java     | 199 ++++++----
 .../OID4VCSdJwtIssuingEndpointTest.java       |   1 +
 .../preauth/JwtPreAuthCodeHandlerTest.java    |   1 +
 ...thorizationDetailsFlowPreAuthTestBase.java |   1 +
 .../OID4VCJWTIssuerEndpointPreAuthTest.java   |   3 +
 .../OID4VCPublicClientPreAuthTest.java        |   1 +
 .../OID4VCredentialOfferPreAuthTest.java      | 373 ++++++++++++------
 .../oid4vc/CredentialOfferUriRequest.java     |   9 +-
 17 files changed, 587 insertions(+), 285 deletions(-)

diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
index 0377a7992f4c..a35dd38e0503 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/OID4VCIssuerEndpoint.java
@@ -343,7 +343,7 @@ private void checkClientEnabled(EventBuilder eventBuilder) {
     }
 
     /**
-     * the OpenId4VCI nonce-endpoint
+     * The OID4VCI nonce endpoint
      *
      * @return a short-lived c_nonce value that must be presented in key-bound proofs at the credential endpoint.
      * @see <a href="https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-16.html#name-nonce-endpoint">Nonce endpoint</a>
@@ -404,37 +404,42 @@ public Response createCredentialOfferPreflight() {
      * Creates an authorization code grant offer that is bound to the calling user.
      */
     public Response createCredentialOffer(String credConfigId) {
-        return createCredentialOffer(credConfigId, false, null);
+        return createCredentialOffer(credConfigId, false, null, null, null, OfferResponseType.URI, 0, 0);
     }
 
     /**
      * Creates a Credential Offer that is bound to a specific user.
      */
     public Response createCredentialOffer(String credConfigId, boolean preAuthorized, String targetUser) {
-        return createCredentialOffer(credConfigId, preAuthorized, targetUser, null, OfferResponseType.URI, 0, 0);
+        return createCredentialOffer(credConfigId, preAuthorized, targetUser, null, null, OfferResponseType.URI, 0, 0);
     }
 
     /**
-     * Creates a Credential Offer that can be pre-authorized and/or bound to a specific target user.
+     * Creates a Credential Offer that can be pre-authorized and/or bound to a specific target user and client.
      * <p>
-     * Credential Offer Validity Matrix for the supported request parameters "pre_authorized", "targetUser" combinations.
+     * Credential Offer Validity Matrix for the supported request parameters.
      * </p>
-     * +----------+----------+---------+--------------------------------------------+
-     * | Pre-Auth | Username | Valid   | Notes                                      |
-     * +----------+----------+---------+--------------------------------------------+
-     * | no       | no       | yes     | Anonymous offer; works for any login user. |
-     * | no       | yes      | yes     | Offer restricted to a specific user.       |
-     * +----------+----------+---------+--------------------------------------------+
-     * | yes      | no       | yes     | Self issued pre-auth offer.                |
-     * | yes      | yes      | yes     | Offer restricted to a specific user.       |
-     * +----------+----------+---------+--------------------------------------------+
+     * +----------+----------+-----------------+---------+------------------------------------------------------+
+     * | Pre-Auth | Username | Client          | Valid   | Notes                                                |
+     * +----------+----------+-----------------+---------+------------------------------------------------------+
+     * | no       | no       | no              | yes     | Anonymous offer; any logged-in user may redeem.      |
+     * | no       | no       | explicit        | yes     | Anonymous offer; bound to a specific client.         |
+     * | no       | yes      | no              | yes     | Offer restricted to a specific user.                 |
+     * | no       | yes      | explicit        | yes     | Offer restricted to a specific user and client.      |
+     * +----------+----------+-----------------+---------+------------------------------------------------------+
+     * | yes      | no       | explicit/unique | yes     | Defaults to the user from the current login session  |
+     * | yes      | yes      | explicit        | yes     | Pre-auth for a specific target user and client.      |
+     * | yes      | yes      | omitted unique  | yes     | Discovered from credential_configuration_id.         |
+     * | yes      | yes      | omitted none    | no      | Discovery fails: no OID4VCI client has that scope.   |
+     * | yes      | yes      | omitted multi   | no      | Discovery fails: multiple clients match.             |
+     * +----------+----------+-----------------+---------+------------------------------------------------------+
      * </p>
      * <b>Pre-Authorized Code Grant Offer</b>
      * <ul>
-     *   <li>A pre-authorized offer is authorized for the clientId from the current login session</li>
      *   <li>If targetUser is null or empty, it defaults to the user from the current login session</li>
      *   <li>If targetUser is equal to the current login, the generated offer is "self issued"</li>
      *   <li>To create an offer for another user, the issuing user must hold the {@code credential_offer_create} role</li>
+     *   <li>A targetClient can explicitly be given or be discovered; the offer is scoped to that client</li>
      *   <li>A pre-authorized offer can optionally have an associated tx_code</li>
      *   <li>An offer can optionally have a predefined expiry date</li>
      * </ul>
@@ -443,8 +448,8 @@ public Response createCredentialOffer(String credConfigId, boolean preAuthorized
      * <ul>
      *   <li>If targetUser is null or empty, the generated offer is "anonymous"</li>
      *   <li>If targetUser is equal to the current login, the offer is "self issued"</li>
-     *   <li>If targetUser is none of the above, the offer is "targeted"</li>
-     *   <li>For a targeted offer, the issuing user must hold the {@code credential_offer_create} role</li>
+     *   <li>To create an offer for another user, the issuing user must hold the {@code credential_offer_create} role</li>
+     *   <li>A targetClient may be given, in which case the offer is scoped to that client</li>
      *   <li>An offer can optionally have a predefined expiry date</li>
      * </ul>
      *
@@ -468,6 +473,7 @@ public Response createCredentialOffer(String credConfigId, boolean preAuthorized
      * @param credentialConfigurationId  A valid credential configuration id
      * @param preAuthorized A flag whether the offer should be pre-authorized
      * @param targetUser    The username that the offer is authorized for
+     * @param targetClient  The client_id that the offer is scoped to (optional)
      * @param expiresAt     The date/time when the offer expires (in Unix timestamp seconds)
      * @param responseType  The response type, which can be 'uri', 'qr' or 'uri+qr'
      * @param width         The width of the QR code image
@@ -480,6 +486,7 @@ public Response createCredentialOffer(
             @QueryParam("credential_configuration_id") String credentialConfigurationId,
             @QueryParam("pre_authorized") @DefaultValue("false") Boolean preAuthorized,
             @QueryParam("target_user") String targetUser,
+            @QueryParam("target_client") String targetClient,
             @QueryParam("expire") Integer expiresAt,
             @QueryParam("type") @DefaultValue("uri") OfferResponseType responseType,
             @QueryParam("width") @DefaultValue("200") int width,
@@ -543,17 +550,12 @@ public Response createCredentialOffer(
         String grantType = preAuthorized ? PRE_AUTH_GRANT_TYPE : AUTH_CODE_GRANT_TYPE;
         List<String> credentialConfigurationIds = List.of(credentialConfigurationId);
 
-        // Bind pre-authorized code offers to the authenticated client to prevent redemption from a different client_id.
-        // Authorization Code Grant offers are intentionally not bound to a client_id.
-        // https://github.com/keycloak/keycloak/issues/48188
-        String targetClientId = preAuthorized ? clientModel.getClientId() : null;
-
         CredentialOfferState offerState;
         try {
 
             CredentialOfferProvider offerProvider = session.getProvider(CredentialOfferProvider.class);
             offerState = offerProvider.createCredentialOffer(loginUserModel, grantType,
-                    credentialConfigurationIds, targetClientId, targetUser, expiresAt);
+                    credentialConfigurationIds, targetUser, targetClient, expiresAt);
 
         } catch (CredentialOfferException ex) {
             eventBuilder.detail(Details.REASON, ex.getMessage()).error(ex.getErrorType());
@@ -567,8 +569,9 @@ public Response createCredentialOffer(
         offerStorage.putOfferState(offerState);
 
         String targetUserId = offerState.getTargetUserId();
+        String targetClientId = offerState.getTargetClientId();
         LOGGER.debugf("Stored credential offer state: [grant=%s, ids=%s, cid=%s, uid=%s, nonce=%s]",
-                grantType, credentialConfigurationIds, offerState.getTargetClientId(), targetUserId, offerState.getNonce());
+                grantType, credentialConfigurationIds, targetClientId, targetUserId, offerState.getNonce());
 
         // Add event details
         eventBuilder.detail(Details.VERIFIABLE_CREDENTIAL_PRE_AUTHORIZED, String.valueOf(preAuthorized))
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/CredentialOfferProvider.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/CredentialOfferProvider.java
index 679f4ed97ee1..970c15446c1e 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/CredentialOfferProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/CredentialOfferProvider.java
@@ -79,8 +79,8 @@ CredentialOfferState createCredentialOffer(
             UserModel user,
             String grantType,
             List<String> credentialConfigurationIds,
+            String targetUsername,
             String targetClientId,
-            String targetUserId,
             Integer expireAt
     );
 
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java
index 487a818cdf88..038528ca4151 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/credentialoffer/DefaultCredentialOfferProvider.java
@@ -17,8 +17,11 @@
 package org.keycloak.protocol.oid4vc.issuance.credentialoffer;
 
 import java.util.ArrayList;
+import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 
 import org.keycloak.common.Profile;
 import org.keycloak.events.Errors;
@@ -27,6 +30,7 @@
 import org.keycloak.models.RealmModel;
 import org.keycloak.models.UserModel;
 import org.keycloak.models.oid4vci.CredentialScopeModel;
+import org.keycloak.models.utils.ModelToRepresentation;
 import org.keycloak.protocol.oid4vc.issuance.CredentialOfferException;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCAuthorizationDetailsProcessor;
 import org.keycloak.protocol.oid4vc.issuance.OID4VCIssuerWellKnownProvider;
@@ -38,6 +42,7 @@
 import org.keycloak.protocol.oid4vc.model.PreAuthCodeCtx;
 import org.keycloak.protocol.oid4vc.model.PreAuthorizedCodeGrant;
 import org.keycloak.protocol.oid4vc.utils.OID4VCUtil;
+import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.util.Strings;
 
 import static org.keycloak.OID4VCConstants.OID4VCI_ENABLED_ATTRIBUTE_KEY;
@@ -63,8 +68,7 @@ public CredentialOfferState createCredentialOffer(
             UserModel user,
             String grantType,
             List<String> credentialConfigurationIds,
-            String targetClientId,
-            String targetUsername,
+            String targetUsername, String targetClientId,
             Integer expireAt) {
 
         // Checks whether `--feature=oid4vc_vci_preauth_code` is enabled
@@ -83,16 +87,30 @@ public CredentialOfferState createCredentialOffer(
 
         RealmModel realmModel = this.session.getContext().getRealm();
 
+        Map<String, CredentialScopeModel> credScopeModels = new LinkedHashMap<>();
+        for (String cid : credentialConfigurationIds) {
+            CredentialScopeModel credScopeModel = Optional.ofNullable(findCredentialScopeModelByConfigurationId(
+                    realmModel, () -> session.clientScopes().getClientScopesStream(realmModel), cid))
+                    .orElseThrow(() -> new CredentialOfferException(Errors.INVALID_REQUEST, "No credential scope model for: " + cid));
+            credScopeModels.put(cid, credScopeModel);
+        }
+
         // Validate the target user
         //
         UserModel targetUser = Optional.ofNullable(targetUsername)
                 .map(tu -> validateTargetUser(session, realmModel, user, tu))
                 .orElse(null);
-        String targetUserId = targetUser == null ? null : targetUser.getId();
+        String targetUserId = targetUser != null ? targetUser.getId() : null;
+
+        // Discovery: find the unique OID4VCI-enabled client that has this scope assigned
+        if (preAuthorized && targetClientId == null) {
+            targetClientId = discoverTargetClient(realmModel, credScopeModels);
+        }
 
         // Validate the target client
         if (targetClientId != null) {
-            validateTargetClient(realmModel, targetClientId);
+            List<String> credScopeNames = credScopeModels.values().stream().map(CredentialScopeModel::getName).toList();
+            validateTargetClient(realmModel, targetClientId, credScopeNames);
         }
 
         // Create the CredentialsOffer
@@ -105,16 +123,11 @@ public CredentialOfferState createCredentialOffer(
         //
         CredentialOfferState offerState = new CredentialOfferState(credOffer, targetClientId, targetUserId, expireAt, credOffersId -> {
             List<OID4VCAuthorizationDetail> authDetails = new ArrayList<>();
-            for (String credConfigId : credentialConfigurationIds) {
-                CredentialScopeModel credScope = findCredentialScopeModelByConfigurationId(
-                        realmModel, () -> session.clientScopes().getClientScopesStream(realmModel), credConfigId);
-                if (credScope == null) {
-                    throw new CredentialOfferException(Errors.INVALID_REQUEST, "No credential scope model for: " + credConfigId);
-                }
+            for (CredentialScopeModel credScope : credScopeModels.values()) {
+                String credConfigId = credScope.getCredentialConfigurationId();
                 if (targetUser != null && !OID4VCUtil.hasVerifiableCredential(session, targetUser, credScope)) {
                     throw new CredentialOfferException(Errors.INVALID_REQUEST, "User '" + targetUser.getUsername() + "' does not have verifiable credential '" + credConfigId + "'.");
                 }
-
                 OID4VCAuthorizationDetailsProcessor authDetailsProcessor = new OID4VCAuthorizationDetailsProcessor(session);
                 authDetails.add(authDetailsProcessor.generateResponseAuthorizationDetails(credScope, credOffersId));
             }
@@ -163,11 +176,40 @@ private UserModel validateTargetUser(KeycloakSession session, RealmModel realmMo
         return targetUserModel;
     }
 
-    private void validateTargetClient(RealmModel realm, String clientId) {
-        ClientModel client = session.clients().getClientByClientId(realm, clientId);
-        if (client == null) {
+    /**
+     * Discovers the unique OID4VCI-enabled client that has the given credential scope.
+     * Fails fast if zero or more than one client match.
+     */
+    private String discoverTargetClient(RealmModel realm, Map<String, CredentialScopeModel> credScopeModels) {
+
+        List<ClientModel> candidateClients = session.clients().getClientsStream(realm)
+                .filter(ClientModel::isEnabled)
+                .filter(c -> Boolean.parseBoolean(c.getAttributes().get(OID4VCI_ENABLED_ATTRIBUTE_KEY)))
+                .toList();
+
+        Set<String> credConfigIds = credScopeModels.keySet();
+        List<String> credScopeNames = credScopeModels.values().stream().map(CredentialScopeModel::getName).toList();
+        List<ClientModel> matches = candidateClients.stream()
+                .filter(c -> c.getClientScopes(false).keySet().containsAll(credScopeNames))
+                .toList();
+
+        if (matches.isEmpty()) {
+            throw new CredentialOfferException(Errors.INVALID_REQUEST,
+                    "No OID4VCI client found for credential configuration ids: " + credConfigIds);
+        }
+        if (matches.size() > 1) {
+            throw new CredentialOfferException(Errors.INVALID_REQUEST,
+                    "Multiple OID4VCI clients for credential configuration ids: " + credConfigIds);
+        }
+        return matches.get(0).getClientId();
+    }
+
+    private void validateTargetClient(RealmModel realm, String clientId, List<String> credentialScopeNames) {
+        ClientModel clientModel = session.clients().getClientByClientId(realm, clientId);
+        if (clientModel == null) {
             throw new CredentialOfferException(Errors.CLIENT_NOT_FOUND, "Client '" + clientId + "' not found");
         }
+        ClientRepresentation client = ModelToRepresentation.toRepresentation(clientModel, session);
         if (!client.isEnabled()) {
             throw new CredentialOfferException(Errors.CLIENT_DISABLED, "Client '" + clientId + "' disabled");
         }
@@ -175,6 +217,12 @@ private void validateTargetClient(RealmModel realm, String clientId) {
         if (!oid4vciEnabled) {
             throw new CredentialOfferException(Errors.INVALID_CLIENT, "Client '" + clientId + "' is not enabled for OID4VCI features.");
         }
+        List<String> clientScopes = client.getOptionalClientScopes();
+        for (String scope : credentialScopeNames) {
+            if (!clientScopes.contains(scope)) {
+                throw new CredentialOfferException(Errors.INVALID_CLIENT, "Client '" + clientId + "' does not support '" + scope + "'");
+            }
+        }
     }
 
     /**
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/requiredactions/VerifiableCredentialOfferAction.java b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/requiredactions/VerifiableCredentialOfferAction.java
index ccf0a64778a1..4024a6d2fe42 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/requiredactions/VerifiableCredentialOfferAction.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/issuance/requiredactions/VerifiableCredentialOfferAction.java
@@ -174,14 +174,14 @@ private CredentialOfferState createCredentialsOffer(KeycloakSession session, Rea
         String credentialConfigurationId = actionConfig.getCredentialConfigurationId();
         event = event.clone().detail(Details.CREDENTIAL_TYPE, credentialConfigurationId);
 
-        String clientId = actionConfig.getClientId();
         CredentialOfferProvider offerProvider = session.getProvider(CredentialOfferProvider.class);
         CredentialOfferState offerState = offerProvider.createCredentialOffer(user, grantType,
-                List.of(credentialConfigurationId), clientId, user.getUsername(), expiresAt);
+                List.of(credentialConfigurationId), user.getUsername(), actionConfig.getClientId(), expiresAt);
 
         CredentialOfferStorage offerStorage = session.getProvider(CredentialOfferStorage.class);
         offerStorage.putOfferState(offerState);
 
+        String clientId = offerState.getTargetClientId();
         logger.debugf("Stored credential offer state: [credentialConfigId=%s, clientId=%s, username=%s, nonce=%s]",
                 credentialConfigurationId, clientId, user.getUsername(), offerState.getNonce());
 
diff --git a/services/src/main/java/org/keycloak/protocol/oid4vc/utils/CredentialScopeUtils.java b/services/src/main/java/org/keycloak/protocol/oid4vc/utils/CredentialScopeUtils.java
index 83b1e301d69c..1a7459b02157 100644
--- a/services/src/main/java/org/keycloak/protocol/oid4vc/utils/CredentialScopeUtils.java
+++ b/services/src/main/java/org/keycloak/protocol/oid4vc/utils/CredentialScopeUtils.java
@@ -29,27 +29,32 @@ public class CredentialScopeUtils {
     // Hide ctor
     private CredentialScopeUtils() {}
 
-    public static CredentialScopeModel findCredentialScopeModelByConfigurationId(RealmModel realmModel, Supplier<Stream<ClientScopeModel>> supplier, String credConfigId) {
+    public static List<CredentialScopeModel> findCredentialScopeModelsByConfigurationId(RealmModel realmModel, Supplier<Stream<ClientScopeModel>> supplier, String credConfigId) {
         if (Strings.isEmpty(credConfigId)) {
-            return null;
+            return List.of();
         }
-        List<CredentialScopeModel> credScopes = supplier.get()
+        List<CredentialScopeModel> scopesModels = supplier.get()
                 .filter(it -> it.getProtocol().equals(OID4VC_PROTOCOL))
                 .map(CredentialScopeModel::new)
                 .filter(it -> credConfigId.equals(it.getCredentialConfigurationId()))
                 .toList();
+        return scopesModels;
+    }
+
+    public static CredentialScopeModel findCredentialScopeModelByConfigurationId(RealmModel realmModel, Supplier<Stream<ClientScopeModel>> supplier, String credConfigId) {
+        List<CredentialScopeModel> credScopes = findCredentialScopeModelsByConfigurationId(realmModel, supplier, credConfigId);
         if (credScopes.size() > 1) {
             List<String> clientScopeNames = credScopes.stream().map(ClientScopeModel::getName).toList();
             log.warnf("Multiple client scopes found for credential configuration '%s' in realm '%s': %s",
                     credConfigId, realmModel.getName(), clientScopeNames);
             return null;
-        } else if (credScopes.isEmpty()) {
-            log.warnf("No client scopes found for credential configuration '%s' in realm '%s'",
+        }
+        if (credScopes.isEmpty()) {
+            log.debugf("No client scopes found for credential configuration '%s' in realm '%s'",
                     credConfigId, realmModel.getName());
             return null;
-        } else {
-            return credScopes.get(0);
         }
+        return credScopes.get(0);
     }
 
     public static CredentialScopeModel findCredentialScopeModelByName(RealmModel realmModel, Supplier<Stream<ClientScopeModel>> supplier, String scope) {
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCBasicWallet.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCBasicWallet.java
index 72264075c428..2d9919bfae49 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCBasicWallet.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCBasicWallet.java
@@ -45,6 +45,7 @@
 import org.keycloak.protocol.oidc.representations.OIDCConfigurationRepresentation;
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.representations.idm.UserRepresentation;
 import org.keycloak.sdjwt.vp.SdJwtVP;
 import org.keycloak.testframework.oauth.OAuthClient;
@@ -120,11 +121,11 @@ public OID4VCBasicWallet(Keycloak keycloak, OAuthClient oauth) {
     /**
      * A composite action to create a credential offer uri with caller provided properties
      */
-    public CredentialOfferURI createCredentialOfferUri(OID4VCTestContext ctx, Consumer<CredentialOfferUriRequest> consumer) {
+    public CredentialOfferUriResponse createCredentialOfferUri(OID4VCTestContext ctx, Consumer<CredentialOfferUriRequest> consumer) {
 
         // Get Issuer AccessToken
         //
-        AccessTokenResponse issTokenResponse = getAccessToken(ctx.getIssuer());
+        AccessTokenResponse issTokenResponse = getAccessToken(ctx.getIssuerClient(), ctx.getIssuer());
 
         // Exclude scope: <credScope>
         // Require role: credential-offer-create
@@ -144,7 +145,7 @@ public CredentialOfferURI createCredentialOfferUri(OID4VCTestContext ctx, Consum
             logout(ctx.getIssuer());
         }
 
-        return credOfferUriRes.getCredentialOfferURI();
+        return credOfferUriRes;
     }
 
     /**
@@ -154,7 +155,8 @@ public CredentialsOffer createCredentialOffer(OID4VCTestContext ctx, Consumer<Cr
 
         // Create CredentialOfferURI
         //
-        CredentialOfferURI credOfferUri = createCredentialOfferUri(ctx, consumer);
+        CredentialOfferUriResponse uriResponse = createCredentialOfferUri(ctx, consumer);
+        CredentialOfferURI credOfferUri = uriResponse.getCredentialOfferURI();
 
         // Fetch the CredentialsOffer
         //
@@ -162,19 +164,40 @@ public CredentialsOffer createCredentialOffer(OID4VCTestContext ctx, Consumer<Cr
         return credOfferResponse.getCredentialsOffer();
     }
 
-    public AccessTokenResponse getAccessToken(String username, String... scope) {
-        PkceGenerator pkce = PkceGenerator.s256();
-        AuthorizationEndpointResponse authResponse = authorizationRequest()
-                .scope(scope)
-                .codeChallenge(pkce)
-                .send(username, TEST_PASSWORD);
-        String authCode = authResponse.getCode();
-        assertNotNull(authCode, "No auth code");
-        AccessTokenResponse tokenResponse = oauth.accessTokenRequest(authCode)
-                .codeVerifier(pkce)
-                .send();
-        assertNotNull(tokenResponse.getAccessToken(), "No AccessToken");
-        return tokenResponse;
+    public AccessTokenResponse getAccessToken(ClientRepresentation client, String username, String... scope) {
+        var clientId = oauth.config().getClientId();
+        var clientSecret = oauth.config().getClientSecret();
+        try {
+            oauth.client(client.getClientId(), client.getSecret());
+            PkceGenerator pkce = PkceGenerator.s256();
+            AuthorizationEndpointResponse authResponse = authorizationRequest()
+                    .scope(scope)
+                    .codeChallenge(pkce)
+                    .send(username, TEST_PASSWORD);
+            String authCode = authResponse.getCode();
+            assertNotNull(authCode, "No auth code");
+            AccessTokenResponse tokenResponse = oauth.accessTokenRequest(authCode)
+                    .codeVerifier(pkce)
+                    .send();
+            assertNotNull(tokenResponse.getAccessToken(), "No AccessToken");
+            return tokenResponse;
+        } finally {
+            oauth.client(clientId, clientSecret);
+        }
+    }
+
+    /**
+     * Obtains a bearer token for the given context holder (e.g. alice)
+     */
+    public String getHolderAccessToken(OID4VCTestContext ctx) {
+        return getAccessToken(ctx.getHolderClient(), ctx.getHolder()).getAccessToken();
+    }
+
+    /**
+     * Obtains a bearer token for the given context issuer (e.g. john)
+     */
+    public String getIssuerAccessToken(OID4VCTestContext ctx) {
+        return getAccessToken(ctx.getIssuerClient(), ctx.getIssuer()).getAccessToken();
     }
 
     public CredentialIssuer getIssuerMetadata(OID4VCTestContext ctx) {
@@ -204,7 +227,7 @@ public OIDCClientAttester getClientAttester(OID4VCTestContext ctx) {
     public String buildClientAttestationJWT(OID4VCTestContext ctx, KeyWrapper walletKey) {
         KeyWrapper pubKeyWrapper = walletKey.cloneKey();
         pubKeyWrapper.setPrivateKey(null);
-        String clientId = ctx.getClient().getClientId();
+        String clientId = ctx.getHolderClient().getClientId();
         OIDCClientAttester attester = getClientAttester(ctx);
         String attestationJwt = attester.attestWalletKey(clientId, pubKeyWrapper);
         return attestationJwt;
@@ -215,7 +238,7 @@ public String buildClientAttestationPoPJWT(OID4VCTestContext ctx, KeyWrapper wal
 
         // Build Client Attestation PoP JWT
         //
-        String clientId = ctx.getClient().getClientId();
+        String clientId = ctx.getHolderClient().getClientId();
         ClientAttestationPoPJwt body = new ClientAttestationPoPJwt()
                 .audience(issuer)
                 .issuer(clientId)
@@ -714,4 +737,6 @@ public void assertAccessTokenAudience(String accessToken, String... expectedAudi
         assertEquals(expectedAudience.length, audience.length);
         assertArrayEquals(expectedAudience, audience, "Access token audience should be limited to credential endpoint");
     }
+
+    // Private ---------------------------------------------------------------------------------------------------------
 }
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCCredentialOfferCorsTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCCredentialOfferCorsTest.java
index 87098e02b2d3..cb71f3d5eac5 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCCredentialOfferCorsTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCCredentialOfferCorsTest.java
@@ -328,7 +328,7 @@ private AccessTokenResponse getAccessToken() throws Exception {
     }
 
     private String getCredentialOfferUriUrl() {
-        return getCredentialOfferUriUrl(jwtTypeCredentialConfigurationIdName, true, "john", null);
+        return getCredentialOfferUriUrl(jwtTypeCredentialConfigurationIdName, true, "john", oauth.getClientId());
     }
 
     private String getCredentialOfferUriUrl(String configId, Boolean preAuthorized, String username, String clientId) {
@@ -336,9 +336,9 @@ private String getCredentialOfferUriUrl(String configId, Boolean preAuthorized,
         if (preAuthorized != null)
             res += "&pre_authorized=" + preAuthorized;
         if (clientId != null)
-            res += "&client_id=" + clientId;
+            res += "&target_client=" + clientId;
         if (username != null)
-            res += "&username=" + username;
+            res += "&target_user=" + username;
         return res;
     }
 
@@ -347,6 +347,7 @@ private CredentialOfferURI getCredentialOfferUri(String accessToken) throws Exce
                 .credentialOfferUriRequest(jwtTypeCredentialConfigurationIdName)
                 .preAuthorized(true)
                 .targetUser("john")
+                .targetClient(OID4VCI_CLIENT_ID)
                 .bearerToken(accessToken)
                 .header("Origin", VALID_CORS_URL)
                 .send();
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java
index b126d14bc7f2..ec90cc250c20 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCIssuerTestBase.java
@@ -147,6 +147,7 @@ public abstract class OID4VCIssuerTestBase {
     protected final Logger log = Logger.getLogger(getClass());
 
     public static final String OID4VCI_CLIENT_ID = "oid4vci-client";
+    public static final String OID4VCI_CLIENT_ID2 = "oid4vci-client2";
     public static final String OID4VCI_ABCA_CLIENT_ID = "oid4vci-client-abca";
     public static final String OID4VCI_PUBLIC_CLIENT_ID = "oid4vci-client-pub";
 
@@ -191,6 +192,9 @@ public abstract class OID4VCIssuerTestBase {
     @InjectClient(ref = OID4VCI_CLIENT_ID, config = OID4VCConfidentialClient.class)
     protected ManagedClient managedClient;
 
+    @InjectClient(ref = OID4VCI_CLIENT_ID2, config = OID4VCConfidentialClient2.class)
+    protected ManagedClient managedClient2;
+
     @InjectClient(ref = OID4VCI_ABCA_CLIENT_ID, config = OID4VCAttestationBasedClient.class)
     protected ManagedClient managedAttestationBasedClient;
 
@@ -225,6 +229,7 @@ public abstract class OID4VCIssuerTestBase {
     protected CredentialScopeRepresentation sdJwtNaturalPersonCredentialScope;
 
     protected ClientRepresentation client;
+    protected ClientRepresentation client2;
     protected ClientRepresentation abcaClient;
     protected ClientRepresentation pubClient;
     protected OID4VCBasicWallet wallet;
@@ -262,6 +267,7 @@ public void configureTestRealm() {
     void beforeEachBase() {
 
         client = managedClient.admin().toRepresentation();
+        client2 = managedClient2.admin().toRepresentation();
         pubClient = managedPublicClient.admin().toRepresentation();
         abcaClient = managedAttestationBasedClient.admin().toRepresentation();
 
@@ -976,6 +982,9 @@ public ClientBuilder configure(ClientBuilder client) {
         }
     }
 
+    /**
+     * Confidential OID4VCI Client with some test credential scopes
+     */
     public static class OID4VCConfidentialClient implements ClientConfig {
 
         @Override
@@ -1000,6 +1009,24 @@ public ClientBuilder configure(ClientBuilder client) {
         }
     }
 
+    /**
+     * Confidential OID4VCI Client with no optional client scopes
+     */
+    public static class OID4VCConfidentialClient2 implements ClientConfig {
+
+        @Override
+        public ClientBuilder configure(ClientBuilder client) {
+            client.clientId(OID4VCI_CLIENT_ID2)
+                    .serviceAccountsEnabled(true)
+                    .directAccessGrantsEnabled(true)
+                    .defaultClientScopes("basic", "profile", "roles")
+                    .attribute(OID4VCI_ENABLED_ATTRIBUTE_KEY, "true")
+                    .redirectUris("*")
+                    .secret("test-secret");
+            return client;
+        }
+    }
+
     public static class OID4VCPublicClient implements ClientConfig {
 
         @Override
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCTestContext.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCTestContext.java
index fe0abbb8d15a..87503b0bc06c 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCTestContext.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCTestContext.java
@@ -43,48 +43,65 @@ public class OID4VCTestContext {
     private String issuer;      // Issuing username (i.e. agent who creates credential offers)
     private String holder;      // Holder who requests the credential
 
-    private ClientRepresentation client;
+    private ClientRepresentation holderClient;
+    private ClientRepresentation issuerClient;
     private CredentialScopeRepresentation credentialScope;
 
     private final Map<AttachmentKey<?>, Object> attachments = new HashMap<>();
 
     public OID4VCTestContext(ClientRepresentation client, CredentialScopeRepresentation credentialScope) {
-        this.client = client;
+        this.holderClient = client;
+        this.issuerClient = client;
         this.issuer = "john";
         this.holder = "alice";
         this.credentialScope = credentialScope;
     }
 
-    public ClientRepresentation getClient() {
-        return client;
+    public ClientRepresentation getHolderClient() {
+        return holderClient;
     }
 
-    public void setClient(ClientRepresentation client) {
-        this.client = client;
+    public OID4VCTestContext withHolderClient(ClientRepresentation client) {
+        this.holderClient = client;
+        return this;
     }
 
+    public ClientRepresentation getIssuerClient() {
+        return issuerClient;
+    }
+
+    public OID4VCTestContext withIssuerClient(ClientRepresentation client) {
+        this.issuerClient = client;
+        return this;
+    }
+
+    public String getClientId() { return holderClient.getClientId(); }
+
     public String getIssuer() {
         return issuer;
     }
 
-    public void setIssuer(String issuer) {
+    public OID4VCTestContext withIssuer(String issuer) {
         this.issuer = issuer;
+        return this;
     }
 
     public String getHolder() {
         return holder;
     }
 
-    public void setHolder(String holder) {
+    public OID4VCTestContext withHolder(String holder) {
         this.holder = holder;
+        return this;
     }
 
     public CredentialScopeRepresentation getCredentialScope() {
         return credentialScope;
     }
 
-    public void setCredentialScope(CredentialScopeRepresentation credentialScope) {
+    public OID4VCTestContext setCredentialScope(CredentialScopeRepresentation credentialScope) {
         this.credentialScope = credentialScope;
+        return this;
     }
 
     public List<OID4VCAuthorizationDetail> getAuthorizationDetails() {
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
index c05a36ec1836..10de2a323fd6 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/OID4VCredentialOfferAuthCodeTest.java
@@ -2,8 +2,11 @@
 
 import java.net.URI;
 import java.util.List;
+import java.util.Optional;
+import java.util.function.Function;
 
 import org.keycloak.TokenVerifier;
+import org.keycloak.common.VerificationException;
 import org.keycloak.protocol.oid4vc.model.CredentialDefinition;
 import org.keycloak.protocol.oid4vc.model.CredentialOfferURI;
 import org.keycloak.protocol.oid4vc.model.CredentialResponse;
@@ -11,6 +14,7 @@
 import org.keycloak.protocol.oid4vc.model.OfferResponseType;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.representations.JsonWebToken;
+import org.keycloak.representations.idm.ClientRepresentation;
 import org.keycloak.sdjwt.IssuerSignedJWT;
 import org.keycloak.sdjwt.vp.SdJwtVP;
 import org.keycloak.testframework.annotations.KeycloakIntegrationTest;
@@ -30,6 +34,7 @@
 import static org.keycloak.tests.oid4vc.CredentialOfferStateUtils.getCredentialOfferStateRecord;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
@@ -39,23 +44,22 @@
 /**
  * Credential Offer Validity Matrix
  * <p>
- * +----------+----------+---------+------------------------------------------------------+
- * | Pre-Auth | Username | Valid   | Notes                                                |
- * +----------+----------+---------+------------------------------------------------------+
- * | no       | no       | yes     | Anonymous offer; any logged-in user may redeem.      |
- * | no       | yes      | yes     | Offer restricted to a specific user.                 |
- * +----------+----------+---------+------------------------------------------------------+
- * | yes      | no       | no      | Pre-auth requires a target user.                     |
- * | yes      | yes      | yes     | Pre-auth for a specific target user.                 |
- * +----------+----------+---------+------------------------------------------------------+
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
+ * | Pre-Auth | Username | Client          | Valid   | Notes                                                |
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
+ * | no       | no       | no              | yes     | Anonymous offer; any logged-in user may redeem.      |
+ * | no       | no       | explicit        | yes     | Anonymous offer; bound to a specific client.         |
+ * | no       | yes      | no              | yes     | Offer restricted to a specific user.                 |
+ * | no       | yes      | explicit        | yes     | Offer restricted to a specific user and client.      |
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
  */
 @KeycloakIntegrationTest(config = OID4VCIssuerTestBase.VCTestServerWithRestCredentialOfferEnabled.class)
 public class OID4VCredentialOfferAuthCodeTest extends OID4VCIssuerTestBase {
 
     @Test
-    public void testAuthCodeOffer_Anonymous() throws Exception {
+    public void testAuthCodeOffer_Anonymous() {
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
 
         // Create Authorization Code CredentialOffer
         //
@@ -71,9 +75,9 @@ public void testAuthCodeOffer_Anonymous() throws Exception {
 
         // Verify internal offer state target user and client
         //
-        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
-        assertNull(runtimeOfferState.targetUsername(), "Expected null targetUsername");
-        assertNull(runtimeOfferState.targetClientId(), "Expected null targetClientId");
+        CredentialOfferStateRecord offerState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+        assertNull(offerState.targetUsername(), "Expected null targetUsername");
+        assertNull(offerState.targetClientId(), "Expected null targetClientId");
 
         // Fetch credential offer again
         // https://github.com/keycloak/keycloak/issues/48014
@@ -96,9 +100,85 @@ public void testAuthCodeOffer_Anonymous() throws Exception {
     }
 
     @Test
-    public void testAuthCodeOffer_Anonymous_multipleOffers() throws Exception {
+    public void testAuthCodeOfferMatrix() {
+
+        record MatrixParams(
+                ClientRepresentation issuerClient,
+                String targetUser,
+                ClientRepresentation targetClient
+        ) {
+            String targetClientId() {
+                return Optional.ofNullable(targetClient)
+                        .map(ClientRepresentation::getClientId)
+                        .orElse(null);
+            }
+        }
+
+        Function<MatrixParams, Boolean> runMatrixParams = (p) -> {
+
+            var ctx = createOID4VCTestContext();
+
+            // Create CredentialOfferURI
+            //
+            CredentialOfferUriResponse uriResponse = wallet.createCredentialOfferUri(ctx, req -> {
+                req.targetUser(p.targetUser());
+                req.targetClient(p.targetClientId());
+                req.preAuthorized(false);
+            });
+
+            if (p.targetClient != null && !p.targetClient.getOptionalClientScopes().contains(ctx.getScope())) {
+                assertFalse(uriResponse.isSuccess());
+                assertEquals("invalid_credential_offer_request", uriResponse.getError());
+                String expErrorDescription = String.format("Client '%s' does not support '%s'", p.targetClientId(), ctx.getScope());
+                assertEquals(expErrorDescription, uriResponse.getErrorDescription());
+                return false;
+            }
+            CredentialOfferURI offerURI = uriResponse.getCredentialOfferURI();
+
+            if (p.targetClient != null) {
+                oauth.client(p.targetClient.getClientId(), p.targetClient.getSecret());
+            } else {
+                oauth.client(client.getClientId(), client.getSecret());
+            }
+
+            // Get Credentials Offer
+            //
+            CredentialOfferResponse offerResponse = wallet.credentialsOfferRequest(ctx, offerURI).send();
+            CredentialsOffer credOffer = offerResponse.getCredentialsOffer();
+
+            String issuerState = credOffer.getIssuerState();
+            assertNotNull(issuerState, "No IssuerState");
+
+            // Verify internal offer state target user and client
+            //
+            CredentialOfferStateRecord offerState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+            assertEquals(p.targetUser(), offerState.targetUsername());
+            assertEquals(p.targetClientId(), offerState.targetClientId());
+
+            // Send the CredentialRequest
+            //
+            CredentialResponse credResponse = wallet.fetchCredentialByOffer(ctx, credOffer)
+                    .getCredentialResponse();
+
+            verifyCredentialResponse(ctx, ctx.getHolder(), credResponse);
+
+            wallet.logout(ctx.getHolder());
+
+            return true;
+        };
+
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, null, null)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, null, client)));
+        assertFalse(runMatrixParams.apply(new MatrixParams(client2, null, client2)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, "alice", null)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, "alice", client)));
+        assertFalse(runMatrixParams.apply(new MatrixParams(client2, "alice", client2)));
+    }
+
+    @Test
+    public void testAuthCodeOffer_Anonymous_multipleOffers() {
 
-        var ctx1 = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx1 = createOID4VCTestContext();
 
         // Create Authorization Code CredentialOffer
         //
@@ -191,7 +271,7 @@ public void testAuthCodeOffer_Anonymous_expiredOffer() throws Exception {
         // Bigger accessToken lifespan to avoid same timeout like credential-offer (to enforce that accessToken is still valid in the credential-request, when credential-offer would be invalid)
         testRealm.updateWithCleanup(r -> r.accessTokenLifespan(600));
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
 
         // Create Authorization Code CredentialOffer
         //
@@ -234,62 +314,10 @@ public void testAuthCodeOffer_Anonymous_expiredOffer() throws Exception {
         timeOffSet.set(0);
     }
 
-    @Test
-    public void testAuthCodeOffer_Targeted() throws Exception {
-
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
-
-        // Create Authorization Code CredentialOffer
-        //
-        CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
-            req.targetUser(ctx.getHolder());
-        });
-
-        String issuerState = credOffer.getIssuerState();
-        assertNotNull(issuerState, "No IssuerState");
-
-        CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
-        assertNotNull(offerURI, "No CredentialOfferURI");
-
-        // Verify internal target user and client
-        //
-        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
-        assertEquals("alice", runtimeOfferState.targetUsername());
-        assertNull(runtimeOfferState.targetClientId(), "targetClientId should be null");
-
-        // Send AuthorizationRequest
-        //
-        AuthorizationEndpointResponse authResponse = wallet
-                .authorizationRequest()
-                .scope(ctx.getScope())
-                .issuerState(issuerState)
-                .send(ctx.getHolder(), TEST_PASSWORD);
-        String authCode = authResponse.getCode();
-        assertNotNull(authCode, "No authCode");
-
-        // Build and send AccessTokenRequest
-        //
-        AccessTokenResponse tokenResponse = wallet.accessTokenRequest(ctx, authCode).send();
-        String accessToken = wallet.validateHolderAccessToken(ctx, tokenResponse);
-        assertNotNull(accessToken, "No accessToken");
-
-        String authorizedIdentifier = ctx.getAuthorizedCredentialIdentifier();
-        assertNotNull(authorizedIdentifier, "Has authorized credential identifier");
-
-        // Send the CredentialRequest
-        //
-        CredentialResponse credResponse = wallet.credentialRequest(ctx, accessToken)
-                .credentialIdentifier(authorizedIdentifier)
-                .proofs(wallet.generateJwtProof(ctx))
-                .send().getCredentialResponse();
-
-        verifyCredentialResponse(ctx, ctx.getHolder(), credResponse);
-    }
-
     @Test
     public void testAuthCodeOffer_QRCode() {
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
 
         CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
             req.responseType(OfferResponseType.URI_QR);
@@ -306,37 +334,48 @@ public void testAuthCodeOffer_QRCode() {
     @Test
     public void testAuthCodeOffer_QRCode_InvalidDimensions() {
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
 
-        var ex = assertThrows(IllegalStateException.class, () -> wallet.createCredentialOfferUri(ctx, req -> {
+        CredentialOfferUriResponse uriResponse = wallet.createCredentialOfferUri(ctx, req -> {
             req.responseType(OfferResponseType.URI_QR);
             req.width(1000).height(1000);
-        }));
-        CredentialOfferUriResponse res = ctx.getCredentialsOfferUriResponse();
+        });
+        assertFalse(uriResponse.isSuccess());
 
-        String error = res.getError();
+        String error = uriResponse.getError();
         assertNotNull(error, "No Error");
 
-        String errorDescription = res.getErrorDescription();
+        String errorDescription = uriResponse.getErrorDescription();
         assertNotNull(errorDescription, "No ErrorDescription");
 
-        assertEquals(HttpStatus.SC_BAD_REQUEST, res.getStatusCode());
+        assertEquals(HttpStatus.SC_BAD_REQUEST, uriResponse.getStatusCode());
         assertEquals("invalid_credential_offer_request", error);
         assertEquals("Requested QR Code too large, allowed maximum is 800x800", errorDescription);
-        assertEquals(String.format("[%s] %s", error, errorDescription), ex.getMessage());
     }
 
     // Private ---------------------------------------------------------------------------------------------------------
 
-    private void verifyCredentialResponse(OID4VCTestContext ctx, String expUser, CredentialResponse credResponse) throws Exception {
+    private OID4VCTestContext createOID4VCTestContext() {
+        return new OID4VCTestContext(client, jwtTypeCredentialScope)
+                .withIssuerClient(client2);
+    }
+
+    private void verifyCredentialResponse(OID4VCTestContext ctx, String expUser, CredentialResponse credResponse) {
 
         String scope = ctx.getCredentialScope().getName();
         CredentialResponse.Credential credentialObj = credResponse.getCredentials().get(0);
         assertNotNull(credentialObj, "The first credential in the array should not be null");
 
-        JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialObj.getCredential(), JsonWebToken.class).getToken();
+        JsonWebToken jsonWebToken;
+        try {
+            jsonWebToken = TokenVerifier.create((String) credentialObj.getCredential(), JsonWebToken.class).getToken();
+        } catch (VerificationException e) {
+            throw new RuntimeException(e);
+        }
+
         assertEquals("did:web:test.org", jsonWebToken.getIssuer());
         Object vc = jsonWebToken.getOtherClaims().get("vc");
+
         VerifiableCredential credential = JsonSerialization.mapper.convertValue(vc, VerifiableCredential.class);
         assertEquals(List.of(CredentialDefinition.VERIFIABLE_CREDENTIAL_TYPE, scope), credential.getType());
         assertEquals(URI.create("did:web:test.org"), credential.getIssuer());
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
index e21e34744b99..e6718c5bd723 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/issuance/signing/OID4VCSdJwtIssuingEndpointTest.java
@@ -344,6 +344,7 @@ public void testCredentialIssuance() throws Exception {
                 .credentialOfferUriRequest(credentialConfigurationId)
                 .preAuthorized(true)
                 .targetUser("john")
+                .targetClient(oauth.getClientId())
                 .bearerToken(token)
                 .send()
                 .getCredentialOfferURI();
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/JwtPreAuthCodeHandlerTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/JwtPreAuthCodeHandlerTest.java
index c71429bdaf28..751747b3242c 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/JwtPreAuthCodeHandlerTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/JwtPreAuthCodeHandlerTest.java
@@ -174,6 +174,7 @@ private String createPreAuthOffer() {
 
         CredentialsOffer offer = wallet.createCredentialOffer(ctx, req -> {
             req.targetUser(ctx.getHolder());
+            req.targetClient(ctx.getClientId());
             req.preAuthorized(true);
         });
 
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java
index 2b73695f3f37..f0330bf8017f 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCAuthorizationDetailsFlowPreAuthTestBase.java
@@ -123,6 +123,7 @@ protected Oid4vcTestContext prepareOid4vcTestContext(String token) throws Except
                 .preAuthorized(true)
                 .bearerToken(token)
                 .targetUser("john")
+                .targetClient(OID4VCI_CLIENT_ID)
                 .send();
         assertEquals(HttpStatus.SC_OK, credentialOfferURIResponse.getStatusCode());
         CredentialOfferURI credOfferUri = credentialOfferURIResponse.getCredentialOfferURI();
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCJWTIssuerEndpointPreAuthTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCJWTIssuerEndpointPreAuthTest.java
index 57b7f4cb315b..fa46d6d057c8 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCJWTIssuerEndpointPreAuthTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCJWTIssuerEndpointPreAuthTest.java
@@ -73,6 +73,7 @@ public void testCredentialIssuancePreAuth() {
                 .credentialOfferUriRequest(credentialConfigurationId)
                 .preAuthorized(true)
                 .targetUser("john")
+                .targetClient(client.getClientId())
                 .bearerToken(token)
                 .send()
                 .getCredentialOfferURI();
@@ -163,6 +164,7 @@ public void testPreAuthorizedCodeValidAfterOfferConsumed() {
                 .credentialOfferUriRequest(credentialConfigurationId)
                 .preAuthorized(true)
                 .targetUser("john")
+                .targetClient(oauth.getClientId())
                 .bearerToken(token)
                 .send()
                 .getCredentialOfferURI();
@@ -216,6 +218,7 @@ public void testCredentialOfferRequestWithTamperedNonceSecretIsRejected() {
                 .credentialOfferUriRequest(credentialConfigurationId)
                 .preAuthorized(true)
                 .targetUser("john")
+                .targetClient(oauth.getClientId())
                 .bearerToken(token)
                 .send()
                 .getCredentialOfferURI();
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCPublicClientPreAuthTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCPublicClientPreAuthTest.java
index d9ad4c5f3c86..8c79eb15e6bb 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCPublicClientPreAuthTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCPublicClientPreAuthTest.java
@@ -62,6 +62,7 @@ public void testCredentialFromPreAuthCode() throws Exception {
         //
         CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
             req.targetUser(ctx.getHolder());
+            req.targetClient(ctx.getClientId());
             req.preAuthorized(true);
         });
         String preAuthCode = credOffer.getPreAuthorizedCode();
diff --git a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
index 85196389cb42..91d9f7d61dba 100644
--- a/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
+++ b/tests/base/src/test/java/org/keycloak/tests/oid4vc/preauth/OID4VCredentialOfferPreAuthTest.java
@@ -2,12 +2,16 @@
 
 import java.net.URI;
 import java.util.List;
+import java.util.Optional;
+import java.util.function.Function;
 
 import org.keycloak.TokenVerifier;
 import org.keycloak.admin.client.resource.UserResource;
+import org.keycloak.common.VerificationException;
 import org.keycloak.protocol.oid4vc.model.CredentialDefinition;
 import org.keycloak.protocol.oid4vc.model.CredentialOfferURI;
 import org.keycloak.protocol.oid4vc.model.CredentialResponse;
+import org.keycloak.protocol.oid4vc.model.CredentialScopeRepresentation;
 import org.keycloak.protocol.oid4vc.model.CredentialsOffer;
 import org.keycloak.protocol.oid4vc.model.VerifiableCredential;
 import org.keycloak.representations.JsonWebToken;
@@ -17,8 +21,8 @@
 import org.keycloak.tests.oid4vc.CredentialOfferStateUtils.CredentialOfferStateRecord;
 import org.keycloak.tests.oid4vc.OID4VCIssuerTestBase;
 import org.keycloak.tests.oid4vc.OID4VCTestContext;
-import org.keycloak.testsuite.util.oauth.AccessTokenResponse;
 import org.keycloak.testsuite.util.oauth.oid4vc.CredentialOfferResponse;
+import org.keycloak.testsuite.util.oauth.oid4vc.CredentialOfferUriResponse;
 import org.keycloak.util.JsonSerialization;
 
 import org.junit.jupiter.api.Test;
@@ -28,29 +32,122 @@
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /**
  * Credential Offer Validity Matrix
  * <p>
- * +----------+----------+---------+------------------------------------------------------+
- * | Pre-Auth | Username | Valid   | Notes                                                |
- * +----------+----------+---------+------------------------------------------------------+
- * | no       | no       | yes     | Anonymous offer; any logged-in user may redeem.      |
- * | no       | yes      | yes     | Offer restricted to a specific user.                 |
- * +----------+----------+---------+------------------------------------------------------+
- * | yes      | no       | no      | Pre-auth requires a target user.                     |
- * | yes      | yes      | yes     | Pre-auth for a specific target user.                 |
- * +----------+----------+---------+------------------------------------------------------+
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
+ * | Pre-Auth | Username | Client          | Valid   | Notes                                                |
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
+ * | yes      | no       | explicit/unique | yes     | Defaults to the user from the current login session  |
+ * | yes      | yes      | explicit        | yes     | Pre-auth for a specific target user and client.      |
+ * | yes      | yes      | omitted unique  | yes     | Discovered from credential_configuration_id.         |
+ * | yes      | yes      | omitted none    | no      | Discovery fails: no OID4VCI client has that scope.   |
+ * | yes      | yes      | omitted multi   | no      | Discovery fails: multiple clients match.             |
+ * +----------+----------+-----------------+---------+------------------------------------------------------+
  */
 @KeycloakIntegrationTest(config = OID4VCIssuerTestBase.VCTestServerWithPreAuthCodeEnabled.class)
 public class OID4VCredentialOfferPreAuthTest extends OID4VCIssuerTestBase {
 
+    @Test
+    public void testPreAuthOfferMatrix() {
+
+        record MatrixParams(
+                ClientRepresentation issuerClient,
+                String targetUser,
+                ClientRepresentation targetClient
+        ) {
+            String targetClientId() {
+                return Optional.ofNullable(targetClient)
+                        .map(ClientRepresentation::getClientId)
+                        .orElse(null);
+            }
+        }
+
+        Function<MatrixParams, Boolean> runMatrixParams = (p) -> {
+            String expTargetUser = p.targetUser() != null ? p.targetUser() : "john";
+            String expTargetClient = p.targetClientId() != null ? p.targetClientId() : client.getClientId();
+
+            var otherClients = List.of(abcaClient, pubClient);
+            var ctx = createOID4VCTestContext().withHolder(expTargetUser);
+
+            // Create CredentialOfferURI
+            //
+            CredentialOfferUriResponse uriResponse;
+            try {
+
+                // Remove the credential scope from the two other OID4VCI clients so only oid4vci-client has it
+                if (p.targetClient == null) {
+                    removeOptionalClientScope(otherClients, ctx.getCredentialScope());
+                }
+
+                oauth.client(p.issuerClient.getClientId(), p.issuerClient.getSecret());
+                uriResponse = wallet.createCredentialOfferUri(ctx, req -> {
+                    req.targetUser(p.targetUser());
+                    req.targetClient(p.targetClientId());
+                    req.preAuthorized(true);
+                });
+            } finally {
+                // Restore the credential scope to the two other OID4VCI clients
+                if (p.targetClient == null) {
+                    restoreOptionalClientScope(otherClients, ctx.getCredentialScope());
+                }
+                if (p.targetClient != null) {
+                    oauth.client(p.targetClient.getClientId(), p.targetClient.getSecret());
+                } else {
+                    oauth.client(client.getClientId(), client.getSecret());
+                }
+            }
+            if (p.targetClient != null && !p.targetClient.getOptionalClientScopes().contains(ctx.getScope())) {
+                assertFalse(uriResponse.isSuccess());
+                assertEquals("invalid_credential_offer_request", uriResponse.getError());
+                String expErrorDescription = String.format("Client '%s' does not support '%s'", p.targetClientId(), ctx.getScope());
+                assertEquals(expErrorDescription, uriResponse.getErrorDescription());
+                return false;
+            }
+            CredentialOfferURI offerURI = uriResponse.getCredentialOfferURI();
+
+            // Get Credentials Offer
+            //
+            CredentialOfferResponse offerResponse = wallet.credentialsOfferRequest(ctx, offerURI).send();
+            CredentialsOffer credOffer = offerResponse.getCredentialsOffer();
+
+            String preAuthCode = credOffer.getPreAuthorizedCode();
+            assertNotNull(preAuthCode, "No PreAuthorizedCode");
+
+            // Verify internal offer state target user and client
+            //
+            CredentialOfferStateRecord offerState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
+            assertEquals(expTargetUser, offerState.targetUsername());
+            assertEquals(expTargetClient, offerState.targetClientId());
+
+            // Send the CredentialRequest
+            //
+            CredentialResponse credResponse = wallet.fetchCredentialByOffer(ctx, credOffer)
+                    .getCredentialResponse();
+
+            verifyCredentialResponse(ctx, expTargetUser, credResponse);
+
+            wallet.logout(ctx.getHolder());
+
+            return true;
+        };
+
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, null, null)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, null, client)));
+        assertFalse(runMatrixParams.apply(new MatrixParams(client2, null, client2)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, "alice", null)));
+        assertTrue(runMatrixParams.apply(new MatrixParams(client2, "alice", client)));
+        assertFalse(runMatrixParams.apply(new MatrixParams(client2, "alice", client2)));
+    }
+
     @Test
     public void testPreAuthOffer_DisabledUser() {
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
+
+        String accessToken = wallet.getIssuerAccessToken(ctx);
 
         // Disable user
         UserRepresentation userRep = testRealm.admin().users().search(ctx.getHolder()).get(0);
@@ -59,12 +156,17 @@ public void testPreAuthOffer_DisabledUser() {
         userResource.update(userRep);
 
         try {
-            IllegalStateException error = assertThrows(IllegalStateException.class,
-                    () -> wallet.createCredentialOffer(ctx, req -> {
-                        req.targetUser(ctx.getHolder());
-                        req.preAuthorized(true);
-                    }));
-            assertTrue(error.getMessage().contains("User 'alice' disabled"), error.getMessage());
+            String credConfigId = ctx.getCredentialConfigurationId();
+            CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, credConfigId)
+                    .bearerToken(accessToken)
+                    .targetUser(ctx.getHolder())
+                    .targetClient(ctx.getClientId())
+                    .preAuthorized(true)
+                    .send();
+            String errorDescription = uriResponse.getErrorDescription();
+            assertFalse(uriResponse.isSuccess(), "Expected to fail");
+            assertEquals("invalid_credential_offer_request", uriResponse.getError());
+            assertEquals("User 'alice' disabled", errorDescription);
         } finally {
             userRep.setEnabled(true);
             userResource.update(userRep);
@@ -72,148 +174,169 @@ public void testPreAuthOffer_DisabledUser() {
     }
 
     @Test
-    public void testPreAuthOffer_DisabledClient() throws Exception {
-
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+    public void testPreAuthOffer_DisabledClient() {
 
-        // Create Pre-Authorized CredentialOffer
-        //
-        CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
-            req.targetUser(ctx.getHolder());
-            req.preAuthorized(true);
-        });
+        var ctx = createOID4VCTestContext();
 
-        String preAuthCode = credOffer.getPreAuthorizedCode();
-        assertNotNull(preAuthCode, "preAuthCode");
+        String accessToken = wallet.getIssuerAccessToken(ctx);
 
         // Disable the client
-        ClientRepresentation clientRep = testRealm.admin().clients().get(ctx.getClient().getId()).toRepresentation();
+        ClientRepresentation clientRep = testRealm.admin().clients().get(ctx.getHolderClient().getId()).toRepresentation();
         clientRep.setEnabled(false);
-        testRealm.admin().clients().get(ctx.getClient().getId()).update(clientRep);
+        testRealm.admin().clients().get(ctx.getHolderClient().getId()).update(clientRep);
 
         try {
-            // Attempt to redeem Pre-Authorized Code for AccessToken should fail
-            //
-            AccessTokenResponse tokenResponse = wallet.accessTokenRequestPreAuth(ctx, preAuthCode).send();
-            assertFalse(tokenResponse.isSuccess(), "Token request should have failed for disabled client");
-            assertEquals("invalid_request", tokenResponse.getError());
-            assertTrue(tokenResponse.getErrorDescription().contains("disabled"),
-                    "Error description should mention disabled: " + tokenResponse.getErrorDescription());
+            String credConfigId = ctx.getCredentialConfigurationId();
+            CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, credConfigId)
+                    .bearerToken(accessToken)
+                    .targetUser(ctx.getHolder())
+                    .targetClient(ctx.getClientId())
+                    .preAuthorized(true)
+                    .send();
+            String errorDescription = uriResponse.getErrorDescription();
+            assertFalse(uriResponse.isSuccess(), "Expected to fail");
+            assertEquals("invalid_credential_offer_request", uriResponse.getError());
+            assertEquals("Client 'oid4vci-client' disabled", errorDescription);
         } finally {
-            // Re-enable client
             clientRep.setEnabled(true);
-            testRealm.admin().clients().get(ctx.getClient().getId()).update(clientRep);
+            testRealm.admin().clients().get(ctx.getHolderClient().getId()).update(clientRep);
         }
     }
 
+    /**
+     * Explicit targetClient not found: passing an unknown client_id must fail at offer-creation time.
+     */
+    @Test
+    public void testPreAuthOffer_ExplicitTargetClient_NotFound() {
+
+        var ctx = createOID4VCTestContext();
+
+        CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, ctx.getCredentialConfigurationId())
+                .bearerToken(wallet.getIssuerAccessToken(ctx))
+                .targetUser(ctx.getHolder())
+                .targetClient("non-existent-client")
+                .preAuthorized(true)
+                .send();
+
+        assertFalse(uriResponse.isSuccess(), "Offer creation should have failed for unknown target client");
+        assertEquals("invalid_credential_offer_request", uriResponse.getError());
+        assertTrue(uriResponse.getErrorDescription().contains("non-existent-client"),
+                "Error should mention the unknown client: " + uriResponse.getErrorDescription());
+    }
+
+    /**
+     * Explicit targetClient that is not OID4VCI-enabled: must fail at offer-creation time.
+     */
     @Test
-    public void testPreAuthOffer_SelfIssued() throws Exception {
+    public void testPreAuthOffer_ExplicitTargetClient_NotOid4vciEnabled() {
 
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
+        var ctx = createOID4VCTestContext();
 
-        // Create Pre-Authorized CredentialOffer
-        //
-        CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
-            req.preAuthorized(true);
-            req.targetUser(null);
-        });
+        // Use a well-known Keycloak built-in client that is not OID4VCI-enabled
+        String nonOid4vciClientId = "account";
 
-        String preAuthCode = credOffer.getPreAuthorizedCode();
+        CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, ctx.getCredentialConfigurationId())
+                .bearerToken(wallet.getIssuerAccessToken(ctx))
+                .targetUser(ctx.getHolder())
+                .targetClient(nonOid4vciClientId)
+                .preAuthorized(true)
+                .send();
 
-        CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
-        assertNotNull(offerURI, "No CredentialOfferURI");
+        assertFalse(uriResponse.isSuccess(), "Offer creation should have failed for non-OID4VCI-enabled target client");
+        assertEquals("invalid_credential_offer_request", uriResponse.getError());
+        assertTrue(uriResponse.getErrorDescription().contains(nonOid4vciClientId),
+                "Error should mention the client id: " + uriResponse.getErrorDescription());
+    }
 
-        // Verify internal offer state target user and client
-        //
-        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
-        assertEquals("john", runtimeOfferState.targetUsername());
-        assertEquals(client.getClientId(), runtimeOfferState.targetClientId());
+    /**
+     * Discovery failure — no match: the credential_configuration_id is not assigned to any
+     * OID4VCI-enabled client, so discovery must fail at offer-creation time.
+     */
+    @Test
+    public void testPreAuthOffer_DiscoverTargetClient_NoMatch() {
 
-        // Redeem Pre-Authorized Code for AccessToken
-        //
-        AccessTokenResponse tokenResponse = wallet.accessTokenRequestPreAuth(ctx, preAuthCode).send();
-        assertTrue(tokenResponse.isSuccess(), tokenResponse.getErrorDescription());
+        var ctx = createOID4VCTestContext();
+        String credConfigId = ctx.getCredentialConfigurationId();
 
-        String accessToken = wallet.validateHolderAccessToken(ctx, tokenResponse);
-        assertNotNull(accessToken, "No accessToken");
+        var otherClients = List.of(client, abcaClient, pubClient);
+        try {
+            removeOptionalClientScope(otherClients, ctx.getCredentialScope());
 
-        String authorizedIdentifier = ctx.getAuthorizedCredentialIdentifier();
-        assertNotNull(authorizedIdentifier, "No authorized credential identifier");
+            CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, credConfigId)
+                    .bearerToken(wallet.getIssuerAccessToken(ctx))
+                    .targetUser(ctx.getHolder())
+                    // no targetClient → discovery attempted, should fail
+                    .preAuthorized(true)
+                    .send();
 
-        // Send the CredentialRequest
-        //
-        CredentialResponse credResponse = wallet.credentialRequest(ctx, accessToken)
-                .credentialIdentifier(authorizedIdentifier)
-                .proofs(wallet.generateJwtProof(ctx))
-                .send().getCredentialResponse();
+            assertFalse(uriResponse.isSuccess(), "Offer creation should fail when no client matches");
+            assertEquals("invalid_credential_offer_request", uriResponse.getError());
+            String expError = "No OID4VCI client found for credential configuration ids: [jwt-credential-config-id]";
+            assertEquals(expError, uriResponse.getErrorDescription());
 
-        verifyCredentialResponse(ctx, ctx.getIssuer(), credResponse);
+        } finally {
+            restoreOptionalClientScope(otherClients, ctx.getCredentialScope());
+        }
     }
 
+    /**
+     * Discovery failure — ambiguous: the credential_configuration_id maps to more than one
+     * OID4VCI-enabled client, so discovery must fail with a descriptive error.
+     * <p>
+     * The default realm config assigns all credential scopes as optional to all three OID4VCI
+     * clients, so omitting target_client on jwtTypeCredentialScope always hits this path.
+     */
     @Test
-    public void testPreAuthOffer_Targeted() throws Exception {
-        var ctx = new OID4VCTestContext(client, jwtTypeCredentialScope);
-
-        // Create Pre-Authorized CredentialOffer
-        //
-        CredentialsOffer credOffer = wallet.createCredentialOffer(ctx, req -> {
-            req.targetUser(ctx.getHolder());
-            req.preAuthorized(true);
-        });
-
-        CredentialOfferURI offerURI = ctx.getCredentialsOfferUri();
-        assertNotNull(offerURI, "No CredentialOfferURI");
-
-        // Verify internal offer state target user and client
-        //
-        CredentialOfferStateRecord runtimeOfferState = getCredentialOfferStateRecord(runOnServer, offerURI.getNonce());
-        assertEquals("alice", runtimeOfferState.targetUsername());
-        assertEquals(client.getClientId(), runtimeOfferState.targetClientId());
-
-        String preAuthCode = credOffer.getPreAuthorizedCode();
-        assertNotNull(preAuthCode, "preAuthCode");
-
-        // Fetch credential offer again
-        // https://github.com/keycloak/keycloak/issues/48014
-        credOffer = wallet.credentialsOfferRequest(ctx, offerURI).send().getCredentialsOffer();
-        preAuthCode = credOffer.getPreAuthorizedCode();
-        assertNotNull(preAuthCode, "preAuthCode");
-
-        // Redeem Pre-Authorized Code for AccessToken
-        //
-        AccessTokenResponse tokenResponse = wallet.accessTokenRequestPreAuth(ctx, preAuthCode).send();
-        assertTrue(tokenResponse.isSuccess(), tokenResponse.getErrorDescription());
-
-        String accessToken = wallet.validateHolderAccessToken(ctx, tokenResponse);
-        assertNotNull(accessToken, "No accessToken");
-
-        String authorizedIdentifier = ctx.getAuthorizedCredentialIdentifier();
-        assertNotNull(authorizedIdentifier, "Has authorized credential identifier");
-
-        // Send the CredentialRequest
-        //
-        CredentialResponse credResponse = wallet.credentialRequest(ctx, accessToken)
-                .credentialIdentifier(authorizedIdentifier)
-                .proofs(wallet.generateJwtProof(ctx))
-                .send().getCredentialResponse();
-
-        verifyCredentialResponse(ctx, ctx.getHolder(), credResponse);
-
-        // Attempt to fetch the credential offer again after it has been consumed
-        CredentialOfferResponse res = wallet.credentialsOfferRequest(ctx, offerURI).send();
-        assertEquals("invalid_credential_offer_request", res.getError());
-        assertEquals("Credential offer not found or already consumed", res.getErrorDescription());
+    public void testPreAuthOffer_DiscoverTargetClient_Ambiguous() {
+
+        var ctx = createOID4VCTestContext();
+
+        CredentialOfferUriResponse uriResponse = wallet.credentialOfferUriRequest(ctx, ctx.getCredentialConfigurationId())
+                .bearerToken(wallet.getIssuerAccessToken(ctx))
+                .targetUser(ctx.getHolder())
+                .preAuthorized(true)
+                // no targetClient → multiple clients match → should fail
+                .send();
+
+        assertFalse(uriResponse.isSuccess(), "Offer creation should fail when multiple clients match");
+        assertEquals("invalid_credential_offer_request", uriResponse.getError());
+        assertEquals("Multiple OID4VCI clients for credential configuration ids: [jwt-credential-config-id]", uriResponse.getErrorDescription());
     }
 
     // Private ---------------------------------------------------------------------------------------------------------
 
-    private void verifyCredentialResponse(OID4VCTestContext ctx, String expUser, CredentialResponse credResponse) throws Exception {
+    private OID4VCTestContext createOID4VCTestContext() {
+        return new OID4VCTestContext(client, jwtTypeCredentialScope)
+                .withIssuerClient(client2);
+    }
+
+    private void removeOptionalClientScope(List<ClientRepresentation> clients, CredentialScopeRepresentation credScope) {
+        String scopeId = credScope.getId();
+        for (ClientRepresentation client : clients) {
+            testRealm.admin().clients().get(client.getId()).removeOptionalClientScope(scopeId);
+        }
+    }
+
+    private void restoreOptionalClientScope(List<ClientRepresentation> clients, CredentialScopeRepresentation credScope) {
+        String scopeId = credScope.getId();
+        for (ClientRepresentation client : clients) {
+            testRealm.admin().clients().get(client.getId()).addOptionalClientScope(scopeId);
+        }
+    }
+
+    private void verifyCredentialResponse(OID4VCTestContext ctx, String expUser, CredentialResponse credResponse) {
 
         String scope = ctx.getCredentialScope().getName();
         CredentialResponse.Credential credentialObj = credResponse.getCredentials().get(0);
         assertNotNull(credentialObj, "The first credential in the array should not be null");
 
-        JsonWebToken jsonWebToken = TokenVerifier.create((String) credentialObj.getCredential(), JsonWebToken.class).getToken();
+        JsonWebToken jsonWebToken;
+        try {
+            jsonWebToken = TokenVerifier.create((String) credentialObj.getCredential(), JsonWebToken.class).getToken();
+        } catch (VerificationException e) {
+            throw new RuntimeException(e);
+        }
+
         assertEquals("did:web:test.org", jsonWebToken.getIssuer());
         Object vc = jsonWebToken.getOtherClaims().get("vc");
         VerifiableCredential credential = JsonSerialization.mapper.convertValue(vc, VerifiableCredential.class);
diff --git a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/oid4vc/CredentialOfferUriRequest.java b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/oid4vc/CredentialOfferUriRequest.java
index f22a56e11d27..56f24c1e6a09 100644
--- a/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/oid4vc/CredentialOfferUriRequest.java
+++ b/tests/utils-shared/src/main/java/org/keycloak/testsuite/util/oauth/oid4vc/CredentialOfferUriRequest.java
@@ -16,6 +16,7 @@ public class CredentialOfferUriRequest extends AbstractHttpGetRequest<Credential
     private String credConfigId;
     private Boolean preAuthorized;
     private String targetUser;
+    private String targetClient;
     private Integer expireAt;
     private OfferResponseType responseType;
     private Integer width, height;
@@ -40,6 +41,11 @@ public CredentialOfferUriRequest targetUser(String targetUser) {
         return this;
     }
 
+    public CredentialOfferUriRequest targetClient(String targetClient) {
+        this.targetClient = targetClient;
+        return this;
+    }
+
     public CredentialOfferUriRequest expireAt(Integer expireAt) {
         this.expireAt = expireAt;
         return this;
@@ -66,6 +72,7 @@ protected String getEndpoint() {
         if (!Strings.isEmpty(credConfigId)) builder.queryParam("credential_configuration_id", credConfigId);
         if (preAuthorized != null) builder.queryParam("pre_authorized", preAuthorized);
         if (!Strings.isEmpty(targetUser)) builder.queryParam("target_user", targetUser);
+        if (!Strings.isEmpty(targetClient)) builder.queryParam("target_client", targetClient);
         if (expireAt != null) builder.queryParam("expire", expireAt);
         if (responseType != null) builder.queryParam("type", responseType.getValue());
         if (width != null) builder.queryParam("width", String.valueOf(width));
@@ -75,7 +82,7 @@ protected String getEndpoint() {
 
     @Override
     protected void initRequest() {
-        // All parameters are in the URL for this specific Keycloak test endpoint
+        // All parameters are in the URL for this specific Keycloak endpoint
     }
 
     @Override