Detailed use cases

Two concrete integrations, with the role of each stakeholder in the European digital identity wallet ecosystem.

Who does what

UPFRONT (once) European Union eIDAS 2.0 Issuer National authority, transport pass... Citizen European digital identity wallet Todis verifies the proof, resolves the issuer Your application mobile app, gate, web platform... accredits issues ON EVERY VERIFICATION 1 requests a proof 2 presents 3 trust registry 4 result

Mobile app developer: integrating the wallet online

You're building an app (banking, regulated platform, ticketing) and need to verify that a user meets an age requirement or is who they claim to be, without building the cryptographic exchange with their wallet yourself.

The flow: your backend calls POST /verify/sessions specifying what you need to know (for example "over 18"). Todis returns an authorization request to present to the user (QR code on desktop, direct link on mobile). The user's wallet opens, shows them exactly what's being asked, and they accept or decline. Once the proof is received, Todis verifies it against the EU's official registries and passes you the result, either by polling GET /verify/sessions/{id} or through your own callback logic.

What you don't have to do: register as a trust service provider, handle the OpenID4VP exchange, resolve the wallet's issuer, verify the signature or revocation status. It works today, no accreditation to wait for.

Transport operator: validating a pass through a physical gate

Your network wants to accept transport passes held in the European wallet directly at a gate or an onboard validator, without the rider opening a third-party app or going through a web flow.

The flow is different: your validator captures the presentation over proximity (NFC), in mdoc format (ISO/IEC 18013-5) rather than SD-JWT VC. It sends this presentation to POST /verify/mdoc, which returns within milliseconds whether the pass is valid along with the requested data (pass type, validity). Unlike the web flow, issuer resolution isn't automatic yet for mdoc: you need to send us the relevant issuer's certificate beforehand (contact us before going live).

What you don't have to do: register as a trust service provider, decode the mdoc's CBOR/COSE, verify the digests of the disclosed elements, handle the cryptography of the proximity proof. It works today, no accreditation to wait for.