Support Customer Onboarding and Account Access with EUDI Wallets

Where it fits

How it works

1. 01

   Set an intended use and the attributes needed for that customer journey.

2. 02

   The gateway checks the request before creating a session. An out-of-scope claim is refused before a QR code is issued.

3. 03

   In-scope requests continue to the wallet, and the verification result returns to your existing application flow.

A clear request boundary

{
  "error": "ERR_CLAIM_OUTSIDE_INTENDED_USE",
  "message": "The requested claim is not declared for the selected intended use"
}

For an is_over_18 use, a request for birth_date returns 403 with ERR_CLAIM_OUTSIDE_INTENDED_USE before a session exists. Read the JSON trace and sandbox matrix

First wallet runs

On 10 October 2026, the EU Age Verification app and EUDI Reference Wallet each reached VERIFIED with test credentials: a Proof of Age credential containing age_over_18, and a PID containing given_name and family_name. These runs used test trust sources and do not represent national sandbox results. See the evidence and sandbox matrix

Strong customer authentication

For banks, payment institutions, and e-money issuers, the Gateway has an EUDI TS 12 path for payments, logins, account access, and e-mandates. The wallet signs a hash of the transaction it showed and asserts two factors from different categories; each authentication code is accepted once. The path has only been tested against a synthetic wallet so far, and EU reference wallets do not yet accept TS 12 transaction types. Read the SCA guide for banks

Request boundary

Pilot scope depends on the wallets available in each target market and that market’s implementation of the eIDAS relying-party registration process. The Gateway check is not a lookup in a national register and does not establish that a relying party holds an access or registration certificate. See the evidence and current sandbox status

Plan your target market

Find national wallet initiatives, test environments and official access requirements. Our Wallet Explorer separates service availability from completed DLBR interoperability tests. Explore wallets by country

Data handling

Verification sessions, including selected claims, are stored and processed in Cloudflare’s EU jurisdiction; claims are deleted within 30 seconds of the result. Audit records contain no claim values and are kept in an EU-jurisdiction database. The controller is DALIBOR GOGIC PR DLBR, Serbia; see the privacy notice for the rest of the platform.