NFC Verification API: e-Passport & eID Chip

NFC-based authentication lets you verify identity documents by reading the secure chip embedded in modern passports and IDs using a mobile phone’s NFC capabilities. This provides the highest level of security available for ID Verification.

Key Benefits

Benefit	Description
Highest Security	Verifies cryptographic signatures directly from government issuers
Easy to Use	Works automatically with any NFC-enabled phone
Tamper-Proof	Detects document manipulation invisible to the human eye
Comprehensive Data	Extracts additional data not available through OCR alone
Flexible Fallback	Gracefully falls back to standard verification if NFC isn’t available

How to Enable NFC Verification

Native SDK Integration (Recommended)

NFC verification is available through our native SDKs, which provide full access to device NFC capabilities:

Platform	NFC Support	Documentation
iOS	✅ Full Support	iOS SDK Documentation
Android	✅ Full Support	Android SDK Documentation

The iOS SDK handles all NFC configuration automatically, including:

ISO7816 application identifiers for ePassports
Entitlements and capabilities setup
Real-time chip reading with visual feedback

Web Integration

⚠️ Browser Limitations NFC verification is not available in web browsers due to platform restrictions:
Browser NFC Support
Chrome (Android) Experimental Web NFC API - unstable, requires explicit permissions
Safari (iOS) No Web NFC API support
Other Browsers No support
For web integrations, NFC verification is automatically skipped and users proceed with standard document + selfie verification.

Browser	NFC Support
Chrome (Android)	Experimental Web NFC API - unstable, requires explicit permissions
Safari (iOS)	No Web NFC API support
Other Browsers	No support

How It Works

Session Initiation

The user starts the verification process through your app or platform:

Native SDK: Launch the verification flow directly in your app
Web/Mobile Web: User is guided to use the Didit App for NFC-enabled verification, or continues with standard verification

Document Photo Capture

The user photographs their ID document, capturing:

MRZ (Machine Readable Zone) — used to derive chip access keys
Document front and back images — visual data and security features
Visual security features — holograms, watermarks, microprint

NFC Support Detection

The system automatically checks device and document compatibility:

Check	Description
Document type	Is it an ePassport/eID with an NFC chip?
Device capability	Does the phone support NFC reading?
Permissions	Are the necessary NFC permissions granted?

If NFC is unavailable, verification continues seamlessly with standard document + biometric verification.

NFC Chip Reading

For compatible devices and documents:

User is guided to position their document near the phone’s NFC reader
Visual feedback shows real-time reading progress
Secure communication is established with the chip using PACE/BAC protocols

Data Extraction

The system extracts comprehensive data from the chip following ICAO 9303 standards:

Data Group	Contents	Description
SOD	Document Security Object	Digital signatures for all data groups
DG1	Personal Data	Name, ID number, birth date, expiry date
DG2	Facial Image	High-resolution digital photo of the holder
DG7	Signature	Digital representation of the holder’s signature
DG11-14	Additional Data	May include fingerprints, iris scans (if stored)

Cryptographic Verification

The extracted data undergoes rigorous cryptographic verification:

Digital Signature Verification

Each data group’s hash is verified against the signatures stored in the SOD, ensuring data integrity.

Certificate Chain Validation

The chain of trust is validated: Document Certificate → Country Signing CA → ICAO PKD Root, checking against CSCA master lists and the ICAO Public Key Directory.

Certificate Revocation Check

Certificates are verified against Certificate Revocation Lists (CRLs) to ensure they haven’t been revoked and the document hasn’t been reported stolen/compromised.

Cross-Validation

NFC-extracted data is cross-validated against OCR data from document photos, facial biometric comparison, and MRZ checksum verification.

Result & Confidence Score

The final verification result includes:

Output	Description
NFC verification status	Success, failed, or skipped
Data consistency score	How well NFC data matches visual data
Certificate validation	Full chain verification status
Confidence boost	NFC adds significant confidence to the overall verification

Supported Documents

NFC verification works with ePassports and eIDs that contain an NFC chip, typically indicated by this symbol on the document:

Most passports issued after 2006 contain NFC chips. Coverage varies by country for national ID cards. Check all the supported documents. The Japan My Number Card has a different kind of chip, read through JPKI instead of ICAO 9303. See Japan My Number Card (JPKI).

Japan My Number Card (JPKI)

The Japan My Number Card (マイナンバーカード) has a chip, but not an ICAO 9303 one. It holds certificates issued under JPKI, Japan’s public key infrastructure, and private keys that only sign after the holder enters the card’s PIN. Didit reads it in the same NFC step, through JPKI instead of ICAO 9303, and every NFC result says which protocol was used in chip_protocol (icao or jpki).

Not available yet. My Number Card reading through JPKI is not enabled in production. Until it is, a My Number Card captured in a native SDK skips the NFC step with skip reason JPKI_UNAVAILABLE, and the card is verified with document capture and face match as before.

Requirements

Requirement	Detail
Document	The Japan My Number Card only. Japanese passports keep the ICAO 9303 chip read.
Integration	A native SDK release that reads My Number Cards (iOS, Android, or the React Native and Flutter SDKs built on them). The SDK tells Didit it can read JPKI; an older release skips the step with `JPKI_UNAVAILABLE`. Web and WebView integrations skip it with `INTEGRATION_WITHOUT_NFC_ACCESS`.
Device	A phone with an NFC reader. Without one, the step is skipped with `DEVICE_WITHOUT_NFC`.
iOS host app	`D392F000260100000001` in the app’s ISO7816 select identifiers. See iOS NFC configuration.
Person	Knows the card’s 4-digit PIN, and also its signature password when your workflow asks for the holder’s data.

What the person does

Photograph the card

The person captures the My Number Card in the ID verification step, as with any document. Didit recognizes the card and sends a JPKI NFC step instead of a passport chip read.

Enter the card PIN

The SDK asks for the card’s 4-digit PIN (利用者証明用電子証明書の暗証番号). When the NFC node’s jpki_request_attributes setting is on (the default), it also asks for the signature password, also called the signature PIN (署名用電子証明書の暗証番号, 6 to 16 uppercase letters and numbers).

Hold the card to the phone

The SDK reads the card’s certificates, and the card signs a one-time challenge from Didit with its own key. The SDK uploads the certificates and signatures. The PINs only go to the card, never to Didit.

The card counts wrong entries: it locks the 4-digit PIN after 3 in a row and the signature password after 5, and a locked one has to be reset at the holder’s municipal office. After a wrong entry, the SDK shows how many tries are left. It never makes the last try: when only one is left, it stops and tells the person where to reset it. Ask people to have their PIN and signature password ready before they start.

What Didit checks

Check	What Didit verifies	Warning when it fails (default action)
Certificate chain	Every certificate chains to the JPKI certification authority of its type, is inside its validity period, and is a My Number Card certificate (`jpki.chain_valid`).	`JPKI_CERTIFICATE_INVALID` (Decline)
Card and PIN	The card’s signature over the one-time challenge verifies against its certificate (`jpki.signature_valid`). The card only signs after its PIN is entered, so this proves the person holds the card and knows the PIN.	`JPKI_SIGNATURE_INVALID` (Decline)
Revocation	No certificate has been revoked (`jpki.revocation_status`).	`JPKI_CERTIFICATE_REVOKED` when `revoked` (Decline), `JPKI_REVOCATION_UNCHECKED` when `unchecked` (Review)
Holder data	The name, date of birth, sex and address in the signature certificate match the data read from the photo of the same card (`jpki.attributes_match_ocr`, `jpki.mismatched_attributes`).	`JPKI_AND_OCR_DATA_NOT_SAME` (Review)

Each action is a setting on the NFC node, so you can change it to No action, Review or Decline. See NFC warnings and the NFC feature config.

What an unchecked revocation status means

revocation_status: "unchecked" means Didit verified the certificate chain and the card’s signature, but got no answer on whether a certificate has been revoked. A certificate is revoked when, for example, the card is reported lost. Because a revoked card can’t be ruled out, unchecked is never treated as good. It raises JPKI_REVOCATION_UNCHECKED, which sends the NFC step to review by default. Choose a different outcome with jpki_revocation_unchecked_action. When the certificate chain or the signature is not valid, Didit does not ask about revocation: the status stays unchecked and only the chain or signature warning is raised.

Holder data and privacy

With jpki_request_attributes on, the decision includes the holder’s name, date of birth, sex and address from the signature certificate under jpki.attributes. With it off, the person only enters the 4-digit PIN: the read still proves the card and the PIN, but carries no holder data and is not compared with the photo of the card.
The NFC step never reads the card’s 12-digit Individual Number (My Number) from the chip.
The decision reports what the card proved, never the certificates themselves, their serial numbers or the signatures.

The full result is described in the NFC verification report.

Integration Examples

iOS SDK (Available Now)

import DiditSdk

// NFC is automatically enabled when the document supports it
let config = DiditSdk.Configuration(
    // NFC configuration is handled automatically
    // Just ensure your app has the required entitlements
)

let result = try await DiditSdk.shared.startVerification(
    with: sessionId,
    configuration: config
)

Complete iOS SDK Documentation →

Android SDK (Available Now)

import me.didit.sdk.DiditSdk

// NFC is automatically enabled when the document supports it
DiditSdk.startVerification(
    token = "your-session-token"
) { result ->
    handleResult(result)
}

Android SDK Documentation →

Security Architecture

┌─────────────────────────────────────────────────────────────┐
│                    NFC Verification Flow                     │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│  ┌──────────┐    ┌──────────┐    ┌──────────────────────┐  │
│  │ Document │───▶│  Phone   │───▶│   Didit Backend      │  │
│  │ NFC Chip │    │ NFC Read │    │                      │  │
│  └──────────┘    └──────────┘    │  ┌────────────────┐  │  │
│                                   │  │ ICAO PKD       │  │  │
│                                   │  │ Validation     │  │  │
│                                   │  └────────────────┘  │  │
│                                   │  ┌────────────────┐  │  │
│                                   │  │ CSCA Master    │  │  │
│                                   │  │ List Check     │  │  │
│                                   │  └────────────────┘  │  │
│                                   │  ┌────────────────┐  │  │
│                                   │  │ CRL Revocation │  │  │
│                                   │  │ Check          │  │  │
│                                   │  └────────────────┘  │  │
│                                   └──────────────────────┘  │
│                                              │               │
│                                              ▼               │
│                                   ┌──────────────────────┐  │
│                                   │  Verification Result │  │
│                                   │  + Confidence Score  │  │
│                                   └──────────────────────┘  │
└─────────────────────────────────────────────────────────────┘

Authentication

Verification

Monitoring

Platform

NFC Verification API: e-Passport & eID Chip

Key Benefits

How to Enable NFC Verification

Native SDK Integration (Recommended)

Web Integration

How It Works

Supported Documents

Japan My Number Card (JPKI)

Requirements

What the person does

What Didit checks

What an unchecked revocation status means

Holder data and privacy

Integration Examples

iOS SDK (Available Now)

Android SDK (Available Now)

Security Architecture

FAQ