Verify people with an electronic identity (eID) they already use. Accept Smart-ID, Mobile-ID, Finnish Trust Network and MitID through one workflow, with document fallback when needed.
Trusted by 2,000+ organizations worldwide.
Live
Live
SoonSoonSoon
SoonSoon
Live
SoonSoon
Soon
Soon
SoonSoon
LiveLive
SoonSoon
Soon
Soon
Soon
Soon
+26SoonStatuses distinguish production availability from integration testing. Country coverage describes the configured wallet route, not a completed live identity check in every country. No launch date is promised.
Integration status
Smart-ID, Mobile-ID, Finnish Trust Network and MitID are available. Choose accepted wallets by country and let users authenticate with an eligible identity they already hold. Other listed integrations remain coming soon.
In the console, select the wallets available for each country in your environment. Choose whether a cancelled or failed sign-in falls back to document capture or declines.
Straight from the methods catalog
In the catalog
Countries covered
eIDAS high
LiveLiveSoonSoonSoonNo ordering controls anywhere
Ticking is the whole configuration. The user picks from what you accept, and the order on screen carries no meaning. Each wallet keeps its catalog state until it goes live.
Smart-ID and Mobile-ID flow
MitID · Danish Agency for Digital Government
Admin surfaces only
End users never see an assurance label, a source name, or a price. Your reviewers see all three.
Countries with at least one wallet
Countries
Covered by the EUDI Wallet
Coverage follows the catalog country by country. A flag here means a wallet is listed for that country, not that it is live.
$ curl -X POST https://verification.didit.me/v3/session/ \
-H "x-api-key: <your-api-key>" \
-H "Content-Type: application/json" \
-d '{
"workflow_id": "wf_wallets",
"vendor_data": "user_42"
}'{ "url": "https://verify.didit.me/..." }// Your endpoint receives a signed payload
const crypto = require("node:crypto"); // ESM: import crypto from "node:crypto"
// X-Signature-V2 = HMAC over the canonical JSON, never the raw bytes. Match the sender byte for
// byte: keys sorted by code point, integers digit for digit, floats in Python's repr.
class Num { constructor(src) { this.src = src; } } // a number as written on the wire, not a double
const num = (s) => { if (/^-?\d+$/.test(s)) return BigInt(s).toString(); const n = +s; // ints stay exact
if (Number.isInteger(n)) return BigInt(n).toString(); const [m, e] = n.toExponential().split("e"); // 27.0 -> 27
return +e >= -4 ? String(n) : `${m}e-${String(-e).padStart(2, "0")}`; }; // 1e-05, not 0.00001
const byCodePoint = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)); // UTF-8 order = Python's
const canon = (v) => Array.isArray(v) ? `[${v.map(canon)}]` : v instanceof Num ? num(v.src)
: v && typeof v === "object" ? `{${Object.keys(v).sort(byCodePoint).map((k) => `${JSON.stringify(k)}:${canon(v[k])}`)}}`
: JSON.stringify(v);
// Read the body as text: express.json() would round 1000000000000000129 to a double first.
// Register this route ABOVE any global app.use(express.json()): the first parser to run
// consumes the stream, and a body it already parsed has lost the digits the signature covers.
app.post("/webhooks/didit", express.text({ type: "application/json" }), (req, res) => {
const exact = JSON.parse(req.body, (k, v, c) => typeof v === "number" ? new Num(c.source) : v); // Node 21+
const body = JSON.parse(req.body);
const mac = crypto.createHmac("sha256", SECRET).update(canon(exact), "utf8").digest("hex");
const sig = Buffer.from(String(req.headers["x-signature-v2"] ?? ""));
// Freshness comes from the signed body timestamp; the header alone is unsigned and replayable.
const ts = body.timestamp, fresh = String(ts) === req.headers["x-timestamp"]
&& Math.abs(Date.now() / 1000 - ts) <= 300;
if (!fresh || sig.length !== mac.length
|| !crypto.timingSafeEqual(sig, Buffer.from(mac))) return res.sendStatus(401);
const { status, decision } = body;
// One entry per ID Verification node; pick yours by node_id when you run several.
const [idv] = decision?.id_verifications ?? [];
// idv.verification_method: "document" | "id_lookup" | "wallet"
res.sendStatus(200);
});{ "verification_method": "wallet", "assurance": "cryptographic" }# Didit digital ID wallets — integrate in 5 minutes
You are adding digital ID wallet sign-in to my_stack. The user signs in with a
government or bank digital identity and the wallet returns signed attributes.
Every URL, header, and enum value below is canonical — do not paraphrase or
"improve" them.
## 1. Provision an account
- Sign up: https://business.didit.me (no credit card required).
- Grab the API key for your application from the console.
## 2. Read the methods catalog first
Wallet availability is server-driven per country. Never hard-code a wallet list.
The catalog is not a public REST endpoint. Read it one of two ways:
- Business Console (signed in): your application -> ID Verification ->
Countries tab. https://docs.didit.me/console/id-verification-methods
- Didit MCP server tool didit_workflow_get_id_verification_methods_catalog,
authenticated with the same x-api-key; pass country (ISO 3166-1 alpha-3)
to narrow it to one country. https://docs.didit.me/integration/mcp/tools
- Public mirror of the coverage table (no auth, read-only):
https://docs.didit.me/core-technology/id-verification/verification-methods#coverage
The catalog gives you, per wallet id: the display name, the countries it
covers, the issuing authority, the level of assurance, the availability state,
and the attributes it returns. MitID, Smart-ID, Mobile-ID and Finnish Trust
Network are available. Read the Finnish Trust Network integration guide:
https://docs.didit.me/core-technology/id-verification/finnish-trust-network
iDIN and other wallets remain coming soon until the catalog in
your environment marks them available. Re-read it; do not hard-code a date.
## 3. Create a workflow with the ID Verification (OCR) feature
POST https://verification.didit.me/v3/workflows/
-H "x-api-key: <your-api-key>"
-H "Content-Type: application/json"
The ID Verification feature's enum value is OCR (UPPERCASE — strict enum;
there is no ID_VERIFICATION alias and the API rejects it). Wallets are its
wallet method, accepted per country under config.methods on that same
feature entry, in the same request. Keys are ISO 3166-1 alpha-3.
{
"workflow_label": "Wallet onboarding",
"features": [
{
"feature": "OCR",
"config": {
"methods": {
"DNK": {
"document": { "enabled": true },
"wallet": {
"enabled": true,
"providers": ["mitid"],
"on_failure": "fallback_to_document"
}
},
"FIN": {
"document": { "enabled": true },
"wallet": {
"enabled": true,
"providers": ["ftn"],
"on_failure": "fallback_to_document"
}
}
}
}
}
]
}
Response: the workflow uuid — use it as workflow_id in step 4.
Rules that the API enforces:
- providers is an accept-list, not a ranking. Order carries no meaning and
the end user picks
- on_failure is either fallback_to_document or decline. It covers all three
cases: no wallet, cancelled, sign-in failed
- a wallet id the catalog does not mark available for that country is
rejected, and the rejection fails the whole save — including any lookup
configuration next to it. For unavailable wallets, keep wallet.enabled
false (or omit the wallet block) so the save succeeds
- unknown wallet ids already saved on a workflow are preserved untouched, so
a config written by a newer console version is never silently dropped
- a country with no method enabled is rejected at publish time
## 4. Create a session
POST https://verification.didit.me/v3/session/
-H "x-api-key: <your-api-key>"
-H "Content-Type: application/json"
-d '{ "workflow_id": "<id from step 3>", "vendor_data": "<your user id>" }'
Response: 201 with url (the hosted verification link), session_token and
session_id. Redirect the user to url, or open it in the SDK. The field is
named url — there is no session_url and no verification_url. Didit
shows the accepted wallets for the user's country with their brand marks,
hands off to the wallet, and waits for the signed assertion to come back.
## 5. Webhooks
Register a destination (console -> API & Webhooks, or
POST https://verification.didit.me/v3/webhook/destinations/ with
webhook_version "v3" and subscribed_events ["status.updated"]) and store the
secret_shared_key it returns. Verify every delivery:
Header: X-Signature-V2 (NOT X-Signature, NOT X-Signature-Simple)
Algorithm: HMAC-SHA256, hex digest, over the CANONICAL JSON of the payload
— the sender's Python json.dumps(sort_keys=True,
separators=(",", ":"), ensure_ascii=False) after whole-valued
floats become ints. Reproduce those bytes EXACTLY; do NOT
"parse, sort keys, JSON.stringify", which fails in four ways:
numbers come from the wire TEXT, never from parsed doubles
(read the body with express.text, not express.json(),
registered ABOVE any global app.use(express.json()), and
re-emit integers through BigInt(source) — JSON.parse rounds
1000000000000000129); floats use Python's repr (1e-05, not
0.00001; 27.0 becomes 27); keys sort by Unicode CODE POINT as
strings ("10" before "2", U+FF21 before U+1F642, which
JavaScript's default .sort() reverses); and the bytes come
straight from the sorted entries, never from a rebuilt object.
Do NOT hash the raw request bytes — that is the v1
X-Signature algorithm and fails for V2 whenever whitespace or
key order differs from the canonical form.
Freshness: the signed body field timestamp is the dispatch time (Unix
seconds, refreshed on every retry). Reject when
abs(now - timestamp) > 300 seconds, and reject when the
X-Timestamp header does not equal it. The header is not
covered by the signature, so it must never be the only replay
check: a captured delivery replays with just that header
refreshed.
Compare: constant-time (crypto.timingSafeEqual)
Reference handler (Express) — use it as written:
// Your endpoint receives a signed payload
const crypto = require("node:crypto"); // ESM: import crypto from "node:crypto"
// X-Signature-V2 = HMAC over the canonical JSON, never the raw bytes. Match the sender byte for
// byte: keys sorted by code point, integers digit for digit, floats in Python's repr.
class Num { constructor(src) { this.src = src; } } // a number as written on the wire, not a double
const num = (s) => { if (/^-?\d+$/.test(s)) return BigInt(s).toString(); const n = +s; // ints stay exact
if (Number.isInteger(n)) return BigInt(n).toString(); const [m, e] = n.toExponential().split("e"); // 27.0 -> 27
return +e >= -4 ? String(n) : `${m}e-${String(-e).padStart(2, "0")}`; }; // 1e-05, not 0.00001
const byCodePoint = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)); // UTF-8 order = Python's
const canon = (v) => Array.isArray(v) ? `[${v.map(canon)}]` : v instanceof Num ? num(v.src)
: v && typeof v === "object" ? `{${Object.keys(v).sort(byCodePoint).map((k) => `${JSON.stringify(k)}:${canon(v[k])}`)}}`
: JSON.stringify(v);
// Read the body as text: express.json() would round 1000000000000000129 to a double first.
// Register this route ABOVE any global app.use(express.json()): the first parser to run
// consumes the stream, and a body it already parsed has lost the digits the signature covers.
app.post("/webhooks/didit", express.text({ type: "application/json" }), (req, res) => {
const exact = JSON.parse(req.body, (k, v, c) => typeof v === "number" ? new Num(c.source) : v); // Node 21+
const body = JSON.parse(req.body);
const mac = crypto.createHmac("sha256", SECRET).update(canon(exact), "utf8").digest("hex");
const sig = Buffer.from(String(req.headers["x-signature-v2"] ?? ""));
// Freshness comes from the signed body timestamp; the header alone is unsigned and replayable.
const ts = body.timestamp, fresh = String(ts) === req.headers["x-timestamp"]
&& Math.abs(Date.now() / 1000 - ts) <= 300;
if (!fresh || sig.length !== mac.length
|| !crypto.timingSafeEqual(sig, Buffer.from(mac))) return res.sendStatus(401);
const { status, decision } = body;
// One entry per ID Verification node; pick yours by node_id when you run several.
const [idv] = decision?.id_verifications ?? [];
// idv.verification_method: "document" | "id_lookup" | "wallet"
res.sendStatus(200);
});
Body fields you will use: session_id, status, webhook_type, workflow_id,
vendor_data, decision.
Status values: Approved, Declined, In Review, In Progress, Not Started,
Abandoned.
## 6. Reading the result
The decision is the V3 shape: every feature result is a plural array with one
entry per workflow node. ID Verification results live in
decision.id_verifications[] — there is no singular decision.kyc (that is the
V2 shape) and no decision.id_verification. Select your entry by node_id (the
id of your ID Verification node in the workflow graph); with a single ID step,
take index 0. Each entry carries, next to the document fields:
verification_method "document" | "id_lookup" | "wallet"
assurance "documentary" | "data_match" | "cryptographic"
wallet_provider the catalog wallet id the user signed in with; null
on document and id_lookup entries
wallet_verification provider, provider_name, issuing_authority,
issuing_country, credential_type, level_of_assurance
(low | substantial | high), verified_at,
signature_valid, attributes (what the wallet shared),
portrait when the wallet shares one; null otherwise
fallback_from { method, reason, action } when the session fell
back to document capture or was declined; else null
A wallet entry that succeeds is assurance cryptographic — the highest of the
three. Check wallet_verification.signature_valid before you trust attributes.
Field-by-field reference: https://docs.didit.me/reference/data-models#id-verification
## 7. Billing
- published customer prices in USD per completed wallet verification:
- MitID personal: $0.25; production availability: Available
- BankID Sweden: $0.20; production availability: Available
- Finnish Trust Network: $0.25; production availability: Available
- Smart-ID: $0.20; production availability: Available
- Mobile-ID: $0.20; production availability: Available
- BankID Norway High: $0.35; production availability: Coming soon
- Vipps Plus: $0.25; production availability: Coming soon
- Buypass ID: Coming soon; production availability: Coming soon
- itsme: Coming soon; production availability: Coming soon
- iDIN full identification: $0.85; production availability: Coming soon
- Personalausweis Profile 2: $0.45; production availability: Coming soon
- Freja eID: $0.25; production availability: Coming soon
- UAE PASS: Coming soon; production availability: Coming soon
- gov.br: Coming soon; production availability: Coming soon
- OneID: $2.50; production availability: Coming soon
- GOV.UK Wallet: Coming soon; production availability: Coming soon
- Bank iD: Coming soon; production availability: Coming soon
- MojeID: Coming soon; production availability: Coming soon
- Diia: Coming soon; production availability: Coming soon
- FranceConnect: Coming soon; production availability: Coming soon
- Auðkenni: Coming soon; production availability: Coming soon
- ConnectID: Coming soon; production availability: Coming soon
- EUDI Wallet: Coming soon; production availability: Coming soon
- Estonian ID-card: Coming soon; production availability: Coming soon
- eParaksts: Coming soon; production availability: Coming soon
- an announced price does not enable a wallet; check the live workflow catalog
- wallet checks are outside the document free tier; other checks are billed separately
- full pricing: https://docs.didit.me/core-technology/id-verification/digital-id-wallets#pricing
- document capture bills its own price when the user falls back
## 8. Hard rules — do not change
- base URL for v3 endpoints: verification.didit.me
- auth header: x-api-key (lowercase, hyphenated)
- webhook headers: X-Signature-V2 plus X-Timestamp; canonical JSON, never
raw bytes; freshness from the signed body timestamp
- feature enum: OCR (uppercase) — the ID Verification feature; per-country
methods go under its config.methods
- method keys: document, id_lookup, wallet (lowercase, snake_case)
- wallet ids come from the catalog verbatim, lowercase, snake_case
- country keys: ISO 3166-1 alpha-3, uppercase
- result path: decision.id_verifications[] (array), never decision.kyc
## 9. Verify your integration
- run one session per accepted wallet in sandbox
- assert the id_verifications[] entry for your node has verification_method
wallet and wallet_verification.signature_valid true
- cancel a wallet sign-in and assert your on_failure setting actually fires
- assert your webhook accepts a correctly signed payload with reordered
keys, whitespace and integer-like metadata keys ("10" before "2"), and
rejects a wrong X-Signature-V2, a payload whose signed timestamp is older
than 300 seconds, and that same stale payload with only the X-Timestamp
header refreshed
Docs: https://docs.didit.me/integration/integration-prompt
Prices below are USD per completed wallet verification. They cover the named identity product; other workflow checks and document fallback are billed separately. The 500 free monthly document checks do not cover wallets. An announced price does not mean a wallet is live: availability is shown separately. Available wallets without a published rate show On request; planned wallets without a published rate show Coming soon. Identity wallets verify people; crypto wallet screening is a separate product.
Available means enabled in production. Coming soon means not yet enabled in production, even when integration testing has started. Available wallets appear first.
ConnectID (Australia) is integrated for sandbox testing; production access remains coming soon. Estonian ID-card (Estonia) and eParaksts (Latvia) remain planned integrations. These wallets have no published prices or production launch dates.
Read the detailed documentation| Identity wallet | USD / completed verification | Country / region | Production availability |
|---|---|---|---|
| MitID personal | $0.25 |
| Available |
| BankID Sweden | $0.20 |
| Available |
| Finnish Trust Network | $0.25 |
| Available |
| Smart-ID | $0.20 |
| Available |
| Mobile-ID | $0.20 |
| Available |
| BankID Norway High | $0.35 |
| Coming soon |
| Vipps Plus | $0.25 |
| Coming soon |
| Buypass ID | Coming soon |
| Coming soon |
| itsme | Coming soon |
| Coming soon |
| iDIN full identification | $0.85 |
| Coming soon |
| Personalausweis Profile 2 | $0.45 |
| Coming soon |
| Freja eID | $0.25 |
| Coming soon |
| UAE PASS | Coming soon |
| Coming soon |
| gov.br | Coming soon |
| Coming soon |
| OneID | $2.50 |
| Coming soon |
| GOV.UK Wallet | Coming soon |
| Coming soon |
| Bank iD | Coming soon |
| Coming soon |
| MojeID | Coming soon |
| Coming soon |
| Diia | Coming soon |
| Coming soon |
| FranceConnect | Coming soon |
| Coming soon |
| Auðkenni | Coming soon |
| Coming soon |
| ConnectID | Coming soon |
| Coming soon |
| EUDI Wallet | Coming soon |
| Coming soon |
| Estonian ID-card | Coming soon |
| Coming soon |
| eParaksts | Coming soon |
| Coming soon |
For building, testing, and your first users.
25+ modules, publicly priced. Automatic volume discounts.
For large volumes and regulated programs.
Volume discounts apply automatically as usage grows — no negotiation, no sales call.
Didit is infrastructure for identity and fraud, the platform we wished existed when we were building products ourselves: open, flexible, and developer-friendly, so it works as a real part of your stack instead of a black box you integrate around.
One API covers verifying people (KYC, know your customer), verifying businesses (KYB, know your business), screening crypto wallets (KYT, know your transaction), and monitoring transactions in real time, on a stack built to be:
The footprint underneath: 14,000+ document types in 48+ languages, 1,000+ data sources, and 200+ fraud signals on every session. The Didit infrastructure dynamically learns from every session and gets better every day.
The user authenticates with an existing electronic identity (eID), and Didit checks the signed identity evidence before writing the result to the session. The interaction depends on the wallet: Smart-ID asks for a personal code, while Mobile-ID also asks for a phone number. Both use a comparison code and approval on the user's device.
Wallet authentication is one method inside ID Verification, alongside document capture and non-document lookup. In the workflow API, that feature is named OCR. Available wallets depend on the country and environment. Start with the wallet documentation.
MitID, Smart-ID, Mobile-ID and Finnish Trust Network are available. Smart-ID covers Estonia, Latvia, Lithuania and Belgium; Mobile-ID covers Estonia and Lithuania; Finnish Trust Network covers Finland. MitID serves Denmark. Other listed wallets, including iDIN, BankID, Freja eID, ConnectID and the EUDI Wallet, remain coming soon.
Choose the accepted wallets for each country in the console. The workflow API uses the catalog for your environment and country. Use the integration guide to configure document fallback.
The user chooses an accepted wallet, enters their personal code, and supplies a phone number for Mobile-ID. Didit displays a comparison code. The user checks that the code matches the one on their phone and approves the authentication request there. The PIN is entered only on the user's device, never into Didit.
Didit waits for the signed response, checks the signature and certificate status, and returns verified identity attributes to the session. Completion time depends on the user and wallet response. Follow the Smart-ID and Mobile-ID guide.
Didit checks the authentication signature against the challenge for that session, verifies the certificate against trusted issuers, and checks its revocation status. The returned identity must match the personal code and country used for the request. The hosted flow also validates its session token and rejects repeated completion attempts.
These checks connect the signed response to the expected user and request. They do not replace the need for the user to compare codes and protect their device. Read the verification method, wallet provider and signed attributes on the session result, and verify webhook signatures before using a result in your application. See the technical guide.
One switch covers all three cases: no wallet, cancelled, or sign-in failed. It either falls back to document capture or declines the session, and you set it per country.
The result records the method it fell back from and the reason, so an abandoned wallet sign-in is never invisible.
Smart-ID is available for Estonia, Latvia, Lithuania and Belgium. Mobile-ID is available for Estonia and Lithuania. Mobile-ID is not supported for Latvia. Users need an eligible credential for their selected wallet.
Enable each wallet for the corresponding country in your workflow. Read the Smart-ID and Mobile-ID guide for authentication steps, verified identity fields and document fallback.
Encrypted in transit and at rest, in the region you choose, under SOC 2 Type 1 and Type 2, ISO 27001 and GDPR.
A wallet only shares the attributes the request asks for, and you can untick any optional attribute so it is never stored at all. Required attributes are always stored, together with the signed assertion reference an auditor needs.
Full detail on /security-compliance.
Didit is in production with 2,000+ companies across regulated industries — fintech, banking, iGaming, crypto, marketplaces, healthcare and government.
Wallet sign-in reaches cryptographic assurance, the strongest evidence of the three methods, and the assurance level is recorded on every session. Where a regulator names a specific national eID, accepting that wallet is usually the cleanest way to satisfy it.
Memos on /security-compliance.
Minutes, three ways.
Start at business.didit.me, or read docs.didit.me/integration/integration-prompt.
One API for KYC, KYB, Transaction Monitoring, and Wallet Screening. Integrate in 5 minutes.