German eID integration: Online-Ausweis guide for business
How a business accepts the German Online-Ausweis: eID-Service or identification service, the Berechtigungszertifikat, what you receive, LoA High and GwG § 12, limits, and a document fallback.
In short
To accept the German Online-Ausweis, a business connects to an eID-Service (a hosted eID server) or to an identification service, and needs a state authorisation called a Berechtigungszertifikat unless the identification service holds it. The user taps the ID card on an NFC phone and types a six-digit PIN in the AusweisApp; you receive only the fields your certificate allows.[1][2][9]
- Notified under eIDAS at level of assurance High since 26 September 2017.[3]
- Listed as a valid verification method in the German Anti-Money Laundering Act, GwG § 12.[4]
- 25% of people in Germany have used it; 42% have it ready to use (2025).[10]
An eID-Service is the fastest way for a business to accept the electronic ID (eID) function of the German ID card. The law calls that function the elektronischer Identitätsnachweis; the government and the public call it the Online-Ausweis.[1] It works on the Personalausweis, the electronic residence permit and the eID card for EU and EEA citizens, which together make one eIDAS-notified scheme.[3]
The German eID card at a glance
The chip holds the data; the AusweisApp reads it; an eID server passes the result to the business.[7]
German eID card (Personalausweis)
The Online-Ausweis: the eID function of the German ID card, residence permit and eID card
Adoption: how many people can use it
Having the chip is not the same as using it. The eGovernment MONITOR 2025 measures use directly.[10]
Source: eGovernment MONITOR 2025, Initiative D21 and TU München.[10]
A separate GfK survey of 2,003 adults in October 2024 found 34.9% had activated the function, from 22.4% in Saarland to 53.6% in Berlin, according to Wirtschaftsdienst. The federal dashboard also publishes eID transaction counts as charts.[11]
What the user sees
On a phone, the site hands over to the AusweisApp, according to heise, and the phone's NFC antenna reads the card. On a computer, the user runs the AusweisApp with a card reader.[12][13]
Choose how to verify
Use the online ID function of your ID card.
Online-Ausweis
Use an ID document instead
1The user picks the Online-Ausweis on your site.
Who is asking
Provider name, address and email.
Data requested: name, date of birth.
Certificate valid until its expiry date.
Continue
2The app shows the provider and the requested data before any PIN.[1]
Hold your card
Place the ID card flat against the back of your phone.
3The user holds the card to the NFC phone or a card reader.[13]
Enter your PIN
Your six-digit PIN.
4The user types the six-digit PIN in the AusweisApp.[1]
You are verified
- Full nameShared
- Date of birthShared
- ID numberNot shared
- PortraitNot shared
5The eID server returns the attributes and the browser goes back to your site.[7]
On first use, the holder must replace the one-time PIN from the PIN letter with their own six-digit PIN; until then the online ID is not ready to use, according to the Personalausweisportal. The AusweisApp runs on Android 7.0+, iOS 13.0+, Windows 10 and 11, and macOS 10.15+.[12]
Behind the screens:
User enters the PIN
Simplified. The data is released only after a valid authorisation certificate and the PIN.[1][7]
What an eID-Service returns to your business
The Online-Ausweis returns what your Berechtigungszertifikat (authorisation certificate) lists, and nothing else. PAuswG § 18(5): "Die Übermittlung ist auf die im Berechtigungszertifikat genannten Datenkategorien beschränkt" (transmission is limited to the data categories named in the certificate).[1]
| Attribute | Returned | Note |
|---|---|---|
| Revocation status and validity | Always | Sent with every request[1] |
| Family name, birth name, given names, doctoral degree | Optional | If your certificate lists them[1] |
| Date of birth, place of birth | Optional | If your certificate lists them[1] |
| Address, municipality key | Optional | Read from the chip[1] |
| Nationality, document type, last day of validity | Optional | Plus "D" as the issuing state[1] |
| Age-over or age-under result | Optional | A yes or no without the date of birth[1] |
| Place-of-residence check | Optional | Whether the residence matches the one you ask about[1] |
| Service- and card-specific identifier | Optional | A pseudonym, not a national number[1] |
| ID card number or a national ID number | Never | Not in the § 18(3) list[1] |
| Portrait | Never | Not in the § 18(3) list[1] |
The identifier deserves a note. The eID does not send the card number or any national ID number. What you get instead is the "dienste- und kartenspezifisches Kennzeichen", an identifier tied to both your service and the card.[1] It lets you recognise a returning card, nothing more.
Level of assurance and legal standing
Three layers matter: the ID card law, the EU notification and the AML rules.
| Rule | What it says | Why it matters |
|---|---|---|
| PAuswG § 18 | Defines the eID; usable from age 16; data only after a valid certificate and the PIN[1] | The rules of the sign-in itself |
| PAuswG § 21 | Relying parties need a state authorisation, valid for at most three years[2] | Your Berechtigungszertifikat |
| eIDAS notification | German eID based on Extended Access Control, LoA High, 26 September 2017[3] | Cross-border recognition in the EU |
| GwG § 12(1) sentence 1 no. 2 | The eID is a valid way to verify identity[4] | AML customer due diligence in Germany |
| TKG § 172 | Applies GwG § 8(2) sentence 5 to eID identification[5] | Prepaid SIM registration |
| AMLR Art. 22(6)(b) | eID at assurance level substantial or high, from 10 July 2027[19] | EU-wide AML rule |
The AML text names the eID by its legal basis (original German, gloss below).
§ 12(1) sentence 1 no. 2Geldwäschegesetz (GwG)
"eines elektronischen Identitätsnachweises nach § 18 des Personalausweisgesetzes, nach § 12 des eID-Karte-Gesetzes oder nach § 78 Absatz 5 des Aufenthaltsgesetzes"
Source: Gesetze im Internet, GwG § 12[4]
In English: an electronic proof of identity under the ID card law, the eID card law or the Residence Act.[4]
From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR), Regulation (EU) 2024/1624, applies.[19] Its Article 22(6)(b) allows verification through "the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels 'substantial' or 'high'".[19] Read together, a scheme notified at High appears to satisfy that wording. The Anti-Money Laundering Authority (AMLA) final draft standards of 30 September 2026, sent to the Commission and not yet law, treat these means as the default and document-based remote checks as an alternative the draft would have you justify.[20] The EUDI Wallet fits the same article.
- 26 September 2017NotifiedLoA High on the EU list.
- 29 December 2023PIN reset pausedThe online PIN reset service is suspended.
- 20 May 2026DIdGCabinet approves the wallet law draft.
- 2 January 2027d-youAnnounced launch of the state EUDI Wallet.
- 10 July 2027AMLR appliesArt. 22(6) names eID.
The German eID from notification to the AMLR.[3][14][15][16][19]
How a business connects: Berechtigungszertifikat or eID-Service
The AusweisApp project lists three ways to become a service provider.[9]
Fastest
Identification service
- A provider identifies the user for you
- No Berechtigungszertifikat of your own
- Runs under the provider's certificate
PAuswG § 21b
Common
eID-Service
- A hosted eID server runs the sign-in
- You hold your own authorisation
- Your own brand in the sign-in
PAuswG § 21
Most control
Own eID server
- You run the server yourself
- You hold your own authorisation
- Built to BSI technical guidelines
PAuswG § 21
The three routes described by the AusweisApp project.[6][9]
For your own authorisation, you apply online through the Bundesportal to the Vergabestelle für Berechtigungszertifikate (VfB) at the BVA.[8] Under PAuswG § 21, the VfB grants it when you prove your identity, explain your interest in the data, commit to data protection, and there is no sign of misuse. The authorisation lasts at most three years.[2] The technical certificate then comes from a Berechtigungszertifikate-Anbieter (BerCA), and since summer 2017 one certificate can cover several services.[6]
Certified eID-Service providers exist; the federal portal keeps the list.[7] The reviewed sources did not establish a fee schedule or lead time for the authorisation; ask providers for quotes.
Use cases and sector rules
| Use case | Rule | What the eID gives you |
|---|---|---|
| KYC and AML onboarding | GwG § 12[4] | Name, birth data, address, nationality |
| Prepaid SIM cards | TKG § 172[5] | Identification by eID treated under the GwG rule |
| Age checks for adult content | KJM criteria under the JMStV[17] | An age-over result without the birth date[1] |
| Online gambling accounts | GlüStV 2021 § 6a, according to the Bavarian law portal | The identity fields the treaty asks for |
| Health app sign-in | gematik GesundheitsID[18] | Periodic re-confirmation by eID or health card |
For age checks, the Commission for the Protection of Minors in the Media (KJM) lists the eID function among the face-to-face-equivalent checks for adult closed user groups; it had rated 99 age verification concepts positively by June 2022.[17]
For gambling, the State Treaty on Gambling 2021 § 6a requires player accounts with a verified name, birth name, date and place of birth and residence, according to the Bavarian law portal. The eID can return each of those fields; check with the gambling regulator which methods it accepts.
For signing, we found no primary source on eID onboarding for qualified signatures. The state wallet d-you is announced for 2 January 2027, with legally secure contracts among its first uses.[16]
Limits, security notes and the fallback
- Minors: the eID is usable from age 16.[1]
- Foreigners: only with a German electronic residence permit or the eID card for EU and EEA citizens, which is issued for ten years.[4][21]
- Devices: the user needs an NFC phone or a card reader.[13]
- Forgotten PINs: the online PIN reset service was suspended on 29 December 2023 for an indefinite period, so a forgotten PIN means a trip to the local citizens' office.[14]
- The phone-only Smart-eID was halted on 15 December 2023, according to heise. There is no card-free variant.
Watch out
In February 2024 a researcher showed that a malicious app on the user's phone could hijack the AusweisApp link and capture the PIN, according to heise. The Federal Office for Information Security (BSI) said this was not an attack on the eID system itself.[22] Lost cards are blocked on the 116 116 hotline.[6]
The usual design offers the Online-Ausweis first and sends everyone else to a document check: NFC chip reading of the passport or ID card, liveness and face match. Under the AMLA draft standards, be ready to justify each use of the alternative route.[20]
1Offer the Online-Ausweis first
Show it to users who say they live in Germany.
The user has an eID-ready card, a PIN and NFC
Sign in with the eID
Name, birth data and address from the chip.
Verify with a document
Chip reading, liveness and face match.
2Screen and decide
Run AML screening; the decision stays with you.
Implementation checklist
- Decide whether you need your own Berechtigungszertifikat or an identification service.
- List the exact attributes you need, because the certificate limits what you receive.[1]
- Apply to the VfB through the Bundesportal if you take the own-authorisation route.[8]
- Choose a hosted eID-Service or plan an own server to BSI guidelines.[9]
- Diary the renewal, since an authorisation lasts at most three years.[2]
- Build the document fallback for minors, foreigners and users without a PIN.
- Test on Android, iOS and desktop with a card reader.[12]
- Write user help on the PIN letter, PIN reset and the 116 116 hotline.[6][14]
How Didit helps with eID verification in Germany
The German eID card (Personalausweis) is on Didit's roadmap. In Germany today, Didit verifies users with the document route: NFC chip reading ($0.15), liveness and face match, plus AML screening, in one workflow. A full KYC check costs $0.33 and AML screening $0.20. Other national eIDs already run next to the document route; see MitID integration and the digital ID wallets docs.
Didit provides
- Document checks with NFC chip reading, liveness and face match
- AML screening against sanctions, PEP and watchlists
- The evidence of every check
Stays with you
- The risk assessment and the AML policies
- The onboarding decision
- The choice of which eIDs to accept
Bring the Online-Ausweis to your sign-up
Tell us where your users sign in, and start with the document route today.
Talk to us about German eID card (Personalausweis)Start free
Key takeaways
- You receive only the fields your Berechtigungszertifikat lists, never an ID number or a portrait.
- An identification service lets you start without your own authorisation.
- GwG § 12 names the eID as a valid AML verification method in Germany.
- 42% have it ready to use, so plan a document fallback.
Frequently asked questions
What is an eID-Service?
An eID-Service is a hosted eID server that reads the ID card chip through the AusweisApp and passes the authenticated data to your service. You keep your own authorisation and brand. The federal portal lists the providers.[7][9]
What is a Berechtigungszertifikat?
It is the authorisation certificate that lets a business read data from the German eID. The VfB at the BVA grants the authorisation under PAuswG § 21, for at most three years, and it lists the data categories you may receive.[1][2]
How much does the German eID cost for a business?
The reviewed sources did not establish a federal fee schedule for the authorisation. Some commercial tariffs are public, so ask providers for quotes.
What data does a business receive?
Only the categories in its certificate: for example names, date and place of birth, address, nationality, document type, an age-over result and a service-specific pseudonym. Revocation status and validity are always sent. No ID number and no portrait.[1]
Can minors use the Online-Ausweis?
From age 16. Under PAuswG § 18(1), the holder must be at least 16 years old to use the electronic proof of identity.[1]
Can foreigners use the German eID?
Only with a German electronic residence permit or the eID card for EU and EEA citizens. Everyone else needs a document check.[4][21]
What level of assurance does the German eID have?
High. The German eID based on Extended Access Control was notified under eIDAS on 26 September 2017 and covers the ID card, the residence permit and the eID card.[3]
Does the German eID satisfy AML customer due diligence?
For verifying identity, yes: GwG § 12(1) sentence 1 no. 2 lists it as a valid method. From 10 July 2027, AMLR Article 22(6)(b) also accepts eID means at assurance level substantial or high.[4][19]
Can the eID prove a user is over 18 without the birth date?
Yes. PAuswG § 18(3) includes a check of whether a given age is reached, so you can ask for a yes or no instead of the date of birth.[1]
How long does an integration take?
No public lead time exists for the VfB authorisation. An identification service skips your own authorisation, so it is the quicker start.[9]
What happens if a user forgot the PIN?
The online PIN reset service was suspended on 29 December 2023, so the user resets the PIN at the local citizens' office.[14]
Sources
- Personalausweisgesetz § 18, Elektronischer Identitätsnachweis, Gesetze im Internet.
- Personalausweisgesetz § 21, Berechtigung für Diensteanbieter, Gesetze im Internet.
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, read 5 October 2026.
- Geldwäschegesetz § 12, Identitätsüberprüfung, Gesetze im Internet.
- Telekommunikationsgesetz § 172, Gesetze im Internet.
- Berechtigungszertifikate, Personalausweisportal, Federal Ministry of the Interior.
- eID-Service, Personalausweisportal, Federal Ministry of the Interior.
- Vergabestelle für Berechtigungszertifikate, Bundesverwaltungsamt.
- Become a service provider, AusweisApp.
- eGovernment MONITOR 2025, Initiative D21 and TU München.
- Nutzung: Identifizierung, Dashboard Digitale Verwaltung.
- Software, Personalausweisportal.
- PIN-Rücksetzbrief, federal PIN reset letter site.
- Suspension of the PIN reset and activation service, Personalausweisportal.
- EUDI-Wallet, Federal Ministry for Digital Affairs and State Modernisation (BMDS), press release 24/2026 of 20 May 2026.
- d-you: Deutschland startet digitale Identität für alle, BMDS, press release 53/2026 of 9 September 2026.
- KJM rates four more age verification systems positively, Kommission für Jugendmedienschutz.
- GesundheitsID, gematik.
- Regulation (EU) 2024/1624 (AMLR), EUR-Lex, Articles 22(6) and 90.
- Final Report, draft RTS under Article 28(1) AMLR, AMLA, 30 September 2026.
- eID-Karte der EU und des EWR, Personalausweisportal.
- Hinweis auf eID-Schwachstelle, BSI, 16 February 2024.
Compare every national eID, including the schemes by country, on the eID verification page.
One workflow for every German sign-up
Verify with documents, chip reading and liveness today, and add national eIDs as they arrive.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards