This disclosure provides a method, performed in a wireless device 60, for enabling a secure provisioning of a credential from a server 70. The wireless device 60 stores a device public key and a device private key. The server 70 stores the device public key. The method comprises receiving S1 an authentication request from the server 70; generating S2 a device authentication and integrity, DAI, indicator; and transmitting S3 an authentication response to the server 70. The authentication response comprises the DAI indicator. The method comprises receiving S4 a credential message from the server 70, the credential message comprising a server authentication and integrity, SAI, indicator. The SAI indicator provides a proof of the server's possession of the device public key. The method comprises verifying S5 the received credential message using the device public key.