DigiLocker

In brief: DigiLocker is the government’s digital document wallet. With a customer’s consent, a business can receive issuer-provided documents from DigiLocker instead of uploaded photos.

What is DigiLocker?

DigiLocker is a government-operated digital document wallet, launched under the Digital India programme, in which Indian residents hold documents issued directly by the issuing authority — driving licences, vehicle registration certificates, PAN, education certificates, insurance policies and more. Documents issued into DigiLocker by the source authority are treated as being at par with the original physical document under the applicable Information Technology rules.

For a verifying business, DigiLocker is significant for one reason: the document arrives digitally signed by the body that issued it. There is no scan, no photograph of a card, and therefore nothing meaningful to forge.

DigiLocker: a secure digital locker on a phone storing document folders, with a lock

How a DigiLocker verification flow works

DigiLocker verification means fetching a document straight from the customer’s DigiLocker account, with their consent, instead of asking them to upload a copy. It works in four steps:

The flow is consent-driven throughout. Nothing can be pulled without the customer completing the authorisation, which is both a privacy protection and a product constraint — it adds a step the customer must actively finish.

Why it beats document upload

Upload-based verification asks a machine to judge whether an image of a card is genuine. That is a losing position: image editing is trivial, printed replicas are cheap, and template detection degrades every time an issuing state changes its card design. Issuer-signed retrieval removes the question entirely. It also removes the OCR error rate, since the data arrives as fields rather than as pixels.

DigiLocker: a secure digital locker on a phone storing document folders, with a lock

Where it fits, and what it does not cover

DigiLocker verifies documents the customer holds. It does not confirm third-party facts such as bank account ownership, current employment or a live utility connection — those come from registry lookups against the relevant authority. A typical onboarding stack therefore uses DigiLocker for identity and address documents, then adds attribute checks on top.

It is also worth designing for customers who have no DigiLocker account or cannot complete the authentication, since a mandatory DigiLocker step becomes a hard funnel block for that segment.

Using DigiLocker in a verification flow

The biggest advantage of DigiLocker is the source of the data. Documents in DigiLocker are issued by the authorities that created them, so a business that receives them through DigiLocker is not relying on an image the customer might have edited.

The consent journey

  1. The customer chooses to verify with DigiLocker.
  2. They are redirected to DigiLocker and sign in.
  3. They see which documents are requested and approve sharing.
  4. They return to your flow, and the documents or data arrive with the consent recorded.

Explain this journey in one line before the redirect, so customers are not surprised by leaving your app.

Which documents are commonly used

Aadhaar-based details, PAN, driving licence and vehicle registration are among the documents businesses most often request through DigiLocker. Request only what your process needs; asking for extra documents adds friction and data-protection obligations.

Fallbacks

Some customers do not have a DigiLocker account, or the document they need is not available in it. Offer an alternative route so DigiLocker speeds up most journeys without blocking anyone. More information is on the DigiLocker portal.

Using it in onboarding

For customers, the appeal is simple: documents they already hold in their own account can be shared with a business in a few taps, without scanning or photocopying anything. For businesses, documents arrive from the issuing source rather than as photos, which removes a whole class of tampering and typing errors.

Design the step so that it is optional where possible. Some customers will not have an account, will have forgotten their sign-in, or will not hold every document you need there. Offer a clear fallback, such as an upload with OCR followed by verification, so nobody is stuck. Explain before redirecting why each document is needed, ask only for what the decision requires, and store the consent record with the result.

Finally, test the full journey on a real phone, including the sign-in, the consent screen and the return to your app. Small problems in the hand-off between apps are the most common reason customers abandon this step, and they are easy to fix once you have seen them.

It also helps to watch the numbers after launch. Track how many customers start the step, how many finish it, and where the rest drop off. If many leave at the sign-in screen, make the fallback route more visible; if many leave after the consent screen, look again at how clearly you explain why each document is needed. Small wording changes at these points often make a large difference to completion rates, and they cost almost nothing to test.

Security deserves the same attention. Use the official integration route rather than asking customers for passwords, keep tokens and documents encrypted, and delete anything you do not need once the decision is made. Review who inside your organisation can see shared documents, and log each access so you can answer questions later.

Finally, remember that a shared document confirms what the issuer holds, not who is holding the phone. For higher-risk decisions, combine document sharing with a face match or another check that links the person to the record. Layering checks this way keeps the experience quick for genuine customers while still catching most misuse.

Questions customers ask

Customers often want to know whether the business can see everything in their account. It cannot: only the documents they choose to share are sent, and only for the purpose they agreed to. Saying this clearly on the consent screen removes a common worry.

They also ask what happens if they change their mind. Explain how they can withdraw consent, what that means for their application, and who to contact with questions. Clear answers to these two questions do more for completion rates than any design change, because they address the reason people hesitate in the first place.

What it means for compliance teams

Documents shared this way come with a clear record of when the customer gave consent and what was shared, which makes later reviews much simpler. Keep that record together with the onboarding decision, so an auditor can see the evidence and the outcome side by side.

It also reduces the number of copies you hold. Instead of storing scans of every document, many teams keep only the details their process needs and a reference to the shared record. Fewer copies mean less to protect, a smaller impact if something goes wrong, and simpler answers when customers ask what you hold about them.

Finally, review the step whenever regulations or your products change. A short check each quarter, covering which documents you request and why, keeps the flow lean and makes sure you are not collecting more than you need.

Questions to ask before you integrate

Start by listing the documents your decision actually depends on. Many teams discover that one or two documents are enough for most customers, and that the rest are only needed in specific cases. Asking for less shortens the step and reduces the data you have to protect.

Next, decide what happens when a document is missing from the customer’s account. A clear fallback, such as an upload followed by verification, keeps the application moving instead of forcing the customer to start again later.

Then agree how long you will keep shared documents and who can see them. Writing this down before launch avoids awkward questions from customers and auditors, and it makes deletion routines easy to build into your systems from the start.

Finally, plan how you will measure success. Completion rate, time taken and the share of customers who use the fallback route together show whether the step is working as intended, and they point to the next improvement worth making.

DigiLocker: documents shared from a phone locker to a business laptop with a consent checkmark

Verify it with Veriqos Technologies

Pull issuer-signed documents with consent, and verify the attributes DigiLocker cannot answer:

See how these checks are applied in Fintech & Digital Lending, Insurance Providers.

← Back to the verification glossary

This entry explains how the check works in practice. It is general information, not legal or compliance advice — confirm current requirements against the applicable regulation.