Skip to main content
DigiLocker is a redirect flow. The user signs in to DigiLocker, consents to sharing the documents you asked for, and returns to your application. Documents can only be read after consent completes.
1

Check whether they have an account (optional)

POST /digilocker-simple/v1/user/verify with an Aadhaar number or a mobile reports whether a DigiLocker account exists, so you can route the user to sign-in or sign-up.
2

Initiate a session

POST /digilocker-simple/v1/sessions with the documents you need and an HTTPS redirect_url. Returns a session_id and an authorization_url.
3

Send the user to DigiLocker

Redirect them to authorization_url. They authenticate and grant consent on DigiLocker’s own screens, and are returned to your redirect_url.
4

Wait for consent

Poll GET /digilocker-simple/v1/sessions/{session_id}/status until status is succeeded. Polling is free.
5

Read what they shared

GET /digilocker-simple/v1/sessions/{session_id}/documents/{doc_type} returns the issued files. GET /digilocker-simple/v1/sessions/{session_id}/user/profile returns the account holder’s details.

​
Session states

status is created from the moment the session is initiated until the user finishes granting consent, and succeeded once they have. Reading a profile or a document before then returns 409. Poll the status and retry. The authorization_url is single use. If a user abandons the flow, initiate a new session rather than reusing the URL.

​
Documents

A document is returned as the files DigiLocker issued for it:
Each url expires about an hour after it is issued. Download the file when you receive the response and store it yourself. We do not keep a copy.
Files are the issuer’s own signed documents, byte for byte, so a signature check on one still verifies. Aadhaar and PAN arrive as signed XML, from which the holder’s details can be read.

​
Choosing document types

doc_types accepts aadhaar, pan and driving_license. Each requested type appears on the user’s consent screen, so request only what you need. The doc_type you fetch must be one the user consented to. Any other type returns 404 until you open a new session that includes it.