How it works
- (Optional) Look up whether the investor already has a DigiLocker account.
- Start a session. You get a
session_idand anauthorization_url. - Redirect the investor to
authorization_url. They sign in and consent. - DigiLocker sends them back to your
redirect_url. - Read the result with the
session_id.
session_id is the only thing you carry between steps.
Consent is mandatory. You must pass
consent: true and a consent_purpose of at least 20 characters. We store both as a consent receipt.1. Account lookup (optional)
Decide whether to send the investor down asignin or signup path. Pass one of mobile or aadhaar_number, not both.
2. Start a session
consent(required) — must betrue.consent_purpose(required) — min 20 characters.redirect_url(required) — where the investor lands after consent.documents— any ofaadhaar,pan,driving_licence,email,mobile.state— echoed back to you unchanged.user_flow—signinorsignup.prefill_mobile— pre-verified mobile to skip the signup OTP (withsignup).
3. Consent redirect
After consent, the investor returns to yourredirect_url with query params:
- Granted:
?success=true&id={session_id}&documents=pan+aadhaar&has_verified_data=1 - Denied:
?success=false&id={session_id}&error={error}
id is the session_id. documents lists what they agreed to share.
4. Read the result
One call returns everything the investor consented to. Missing pieces show up undererrors; the rest still comes back.
fetch_documents— documents to parse:pan,aadhaar,driving_licence. Default none.include_documents— include the issued-documents list. Defaulttrue.
signature block with the issuer’s certificate details.
Costs 0.25 credits per call, no matter how many documents you fetch.
Credits
Errors
Frontend note
Don’t ship your API key to the browser. Mint a short-lived access token (at_) from your backend with POST /v1/token and use that.
Next steps
KYC PAN Status
Check a PAN’s KRA registration status
CAS Parsing
Parse portfolio statements

