Skip to content

DOCEZKYC

DigiLocker · Meri Pehchaan integration

Verify identity with DigiLocker

DOCEZKYC retrieves a citizen's Aadhaar, PAN and Driving Licence straight from DigiLocker using the Meri Pehchaan OAuth 2.0 flow. Choose which permissions to request, then continue to DigiLocker to sign in and approve them.

Permissions to request

Ask only for what you need. DigiLocker shows the citizen this same list on its consent screen, and only approved permissions are granted.

Permissions to request from DigiLocker

Required

Needed to read Aadhaar, PAN and Driving Licence

Optional

You will be taken to DigiLocker to sign in and approve these permissions. Only the permissions you approve there are granted — DOCEZKYC cannot read anything else from your account.

DigiLocker is not configured on this deployment: DIGILOCKER_CLIENT_ID is missing; DIGILOCKER_CLIENT_SECRET is missing. Add the environment variables from .env.example, or set DIGILOCKER_DEMO_MODE=1 to preview with sample data.

How the flow works

  1. The citizen picks permissions and is redirected to DigiLocker with a PKCE-protected authorization request.
  2. They sign in at DigiLocker and approve the consent screen.
  3. DigiLocker redirects back with a one-time code, which the server exchanges for an access token and a signed id_token.
  4. The server reads the issued-documents list, pulls the machine-readable XML for Aadhaar, PAN and Driving Licence, and verifies each download's HMAC.