UK Invites Providers to Test Machine-Readable Digital Identity Register

The UK’s Office for Digital Identities and Attributes, known as OfDIA, is inviting digital-verification providers to test the onboarding process for a machine-readable register that will let services check one another’s registered status automatically.

OfDIA plans onboarding tests and interviews during October, followed by technical testing later in 2026. The work covers two models: direct connections between services through application programming interfaces, and exchanges involving digital-credential wallets.

The register supplies information about providers operating within the UK’s digital-verification framework. Making it machine-readable would allow that information to be checked during an identity exchange, alongside the technical credentials used to establish a trusted connection.

For API-based services, providers will register certificates and configuration details. The infrastructure uses X.509 certificates and an OpenID Federation approach to establish trust between participants. Signed metadata will carry information about a provider’s roles and certification profile.

The metadata can describe which government identity-proofing and authentication guidance a service follows, including GPG 44 and GPG 45, and relevant supplementary codes. Certificate registration establishes the technical connection; the signed profile supplies the information used to check the service’s registered scope.

The technical arrangements include mutual TLS, through which both sides authenticate a connection, and controls for certificate expiry and revocation. Providers will use the Digital Verification Services Provider Portal to manage certificate requests and service configurations.

For wallet-based exchanges, the model uses signed issuer and verifier lists associated with the ISO 18013-5 mobile-credential standard. A wallet can check the party requesting information before releasing approved data, while the receiving service can check the credential’s issuer and device authentication.

Wallet interactions can begin through QR codes or near-field communication. The model establishes an encrypted channel for the exchange and checks the participating parties before the approved credential data is transferred.

The testing follows the UK’s transition to digital verification services framework 1.0. The statutory framework operates under the Data (Use and Access) Act 2025 and covers identity services as well as providers of supporting components.

Digital verification is also expanding into right-to-work checks for additional categories of workers. Registered providers supply identity-verification services, while employers retain responsibility for completing the required employment checks.

OfDIA’s October work will assess whether providers can complete onboarding and use the portal successfully before the later technical tests exercise the register’s connections and credential-verification arrangements.

Sources: OfDIA

–

By the ID Tech Editorial Team