EU Digital Identity Wallet

You receive the same fields, with the same names, as for an IDfier user. Nothing changes in how you read results.

In your login flowCopy Anchor Link

After POST /business/auth/request, you can also show a wallet code:

curl -X POST https://api.idfier.com/api/v3/business/auth/wallet \
  -H "clientid: $IDFIER_CLIENT_ID" \
  -H "clientsecret: $IDFIER_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"referenceId":"550e8400-e29b-41d4-a716-446655440000"}'

{
  "status": 100,
  "data": {
    "walletUrl": "haip-vp://?client_id=…&request_uri=…",
    "expiresAt": "2026-10-31T10:05:00.000Z"
  }
}

Show walletUrl as a QR code next to the IDfier code or, on a phone, as a link: it opens the customer's wallet. Calling it again while the request is open returns the same walletUrl. A session that is no longer pending returns 409.

Then poll POST /business/auth/result as usual. When the customer shared from their wallet, session.method is eudi_wallet:

{
  "user": { "id": "u_…", "fullname": "Anna Lindqvist", "ageOver18": true },
  "session": { "status": "approved", "method": "eudi_wallet" }
}

The authentication.completed webhook also carries "method": "eudi_wallet".

A wallet answer only approves a session that is still pending: if the customer already scanned it with the IDfier app, the wallet answer is discarded.

With verification linksCopy Anchor Link

The link page offers "Or use your EU Digital Identity Wallet" by itself. GET /business/links/:id returns method alongside result.

FieldsCopy Anchor Link

A field the wallet's PID doesn't contain is missing from user.

id is per business, as for IDfier users. It is stable for a person when personalNo is among your scopes; otherwise it is tied to the wallet's credential and can change when the wallet renews its PID.

How IDfier verifies a walletCopy Anchor Link

1. IDfier builds an OpenID4VP 1.0 request (HAIP profile) for the PID (urn:eudi:pid:1, SD-JWT VC), asking only for the claims your scopes need.
2. The wallet shows the customer who is asking and what, and sends back an encrypted response.
3. IDfier checks the issuer's certificate chain against the PID providers on the EU trusted list, the issuer's signature, expiry, every selective disclosure, the key binding to this request, and revocation.
4. The session is approved and you read the result as usual. IDfier keeps the verified claims encrypted, for a limited time.