Receive the link
An administrator sends an invitation by e-mail, or a signed-in user starts an account check on the account page. The link opens CodeB Wallet on the phone.
CodeB Wallet · NFC · PID · Photo ID
Open an account with a passport or ID card, no password
CodeB Wallet reads the chip of a passport or ID card, the CodeB server checks it, and the PID and a Photo ID go straight into the same wallet. It works for new accounts and for people who already have one.
ICAO Doc 9303 · SD-JWT VC · ISO mdoc · ISO/IEC 23220 Photo ID · OpenID4VCI · wallet-bound offers
Closed beta. PID and Photo ID are test credentials. Not certified.
In short
- What
- Account opening and account checks with the chip of a passport or ID card, read by CodeB Wallet and checked by the CodeB server.
- Who starts it
- An administrator by e-mail invitation, or the signed-in user from the account page.
- Release
- New account from an invitation: at once. Existing account: first reading by an administrator, later readings of the same person on the same wallet automatically.
- Result
- The account is opened or confirmed; empty profile fields are filled from the chip; names and date of birth are locked.
- Credentials
- PID as SD-JWT VC, Photo ID as ISO mdoc (or SD-JWT VC), offered only to the wallet that read the document.
- Design target
- ETSI TS 119 461 v2.1.1 (extended level of identity proofing) and ARF 3.0. Not certified.
How it works
One link, one reading, two credentials.
Read the chip
CodeB Wallet reads the passport or ID card over NFC. The CodeB server runs the ICAO Doc 9303 checks itself; the phone only passes the encrypted chip messages through.
Release
A new account opened through an invitation is released at once. For an existing account, the first reading waits for an administrator; later readings of the same person on the same wallet are released automatically.
Collect the credentials
The PID and a Photo ID are offered to the wallet that read the document and are bound to its key. No password and no second app are needed.
New account
- An administrator sends an account invitation by e-mail.
- The person opens it on the phone and reads the document.
- The account is opened at once, without a password.
- The PID and the Photo ID are offered right away.
Existing account
- An administrator sends an account check, or the user starts it from the account page.
- The wallet shows the account only masked, for example s***n@example.com.
- Empty profile fields are filled from the chip; names and date of birth are locked.
- The PID and the Photo ID follow after the release.
Security and privacy
Wallet binding
Every offer is bound to the key of the wallet that read the document. Another wallet cannot redeem it.
One document, one account
A document can belong to one account only. A second account with it is refused.
Locked names
After a reading, names and the date of birth come only from the chip, not from typing.
Careful release
Automatic release only for an administrator’s invitation or for the same person on the same wallet an administrator released before.
No CAN or MRZ stored
The access data opens the chip and is then discarded. Raw chip data is not kept.
Evidence without names
Each reading leaves a hash-chained record with results and timings, without personal data.
Standards
- ICAO Doc 9303 (eMRTD)
- SD-JWT VC (IETF)
- ISO/IEC 18013-5 mdoc
- ISO/IEC 23220 data elements for the Photo ID
- OpenID for Verifiable Credential Issuance (OpenID4VCI)
- ETSI TS 119 461 v2.1.1 as design target, not certified
- EU ARF 3.0
Frequently asked questions
How do I open an account with my passport or ID card?
Open the invitation link on an Android phone with CodeB Wallet, hold the passport or ID card to the phone and enter the CAN or the data from the machine-readable zone. The CodeB server checks the chip. The account is opened at once and the PID and a Photo ID are offered to the same wallet.
I already have an account. Can I add my passport or ID card?
Yes. An administrator can send you an account check by e-mail, or you start it yourself on your account page. The data from the chip fills the empty fields of your profile. After the first reading, your names and date of birth are locked and can only be changed by a new reading.
When is a reading released automatically?
A new account opened through an administrator's invitation is released at once, because the administrator chose the person and the chip is genuine. For an existing account, only when an administrator released the same person before and the new reading comes from the same wallet; other genuine readings wait for an administrator. A reading that is not genuine is never released.
Which credentials do I get?
A PID (person identification data) as SD-JWT VC and a Photo ID with the chip photo, by default as ISO mdoc. Both are test credentials during the closed beta. The Photo ID is offered only while the document is valid and never longer than the document.
Do all wallets accept the Photo ID?
The Photo ID is a newer credential type. It can be collected by wallets that support it; support in CodeB Wallet is being tested. The PID works independently of it.
Which data is stored?
The data from the chip and the chip photo are stored in the account. The CAN, the machine-readable zone and the raw chip data are never stored. The evidence record of each reading holds hashes and results without names; the document number is kept only as a keyed hash.
Can one document open several accounts?
No. A document can belong to one account only. A second account with the same document is refused.
Is it certified?
No. It is designed to follow ETSI TS 119 461 v2.1.1 (extended level of identity proofing) and the EU Architecture and Reference Framework (ARF) 3.0, but it is not certified, and no level of assurance is claimed.
Related
Passport & ID card chip check →
How the server checks the chip: PACE, Chip and Active Authentication, Passive Authentication.
CodeB Wallet →
The EU Digital Identity Wallet app for Android.
Sign PDFs with CodeB Wallet →
Signing requests by QR code, with several signers invited by e-mail.
ARF 3.0 conformity →
How the CodeB stack maps to the EU Architecture and Reference Framework.
Identity onboarding for your service?
Write to us about account invitations, account checks and wallet credentials. Testers for CodeB Wallet are welcome too.