How Todis works
Todis verifies a European digital identity proof for you, whether it comes straight from your user's wallet or you already have it in hand. You always get the same thing back: a clear verification result, with only the requested information.
Where national wallets stand. The Todis integration is usable and testable today. The eIDAS 2 wallets your users will install are being rolled out across Member States: the regulation sets a deadline of 24 December 2026 for each of them to have an operational verifier registry. In the meantime, test your integration with a proof you already have in hand, or contact us for access to a test wallet: you'll be ready as soon as your users hold a real wallet.
In three steps
You authenticate with the token received by email at signup.
You ask Todis for a verification: through a guided session with your user's wallet, or directly if you already have their proof in hand.
You get a clear verification result, with only the requested information.
Authenticating
Every call uses the token received by email at signup, passed in
the Authorization: Bearer <token> header. A
missing, invalid, or expired token always returns a 401.
Two ways to integrate
The full flow is the recommended method for the vast majority of integrations. Direct verification remains useful if you already have your user's proof in hand through some other channel.
Full flow (recommended)
You ask Todis to create a verification session, specifying what you want to know (claim):
curl -X POST https://verify.todis.eu/verify/sessions \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"vct": "https://example.eu/credentials/pid",
"claims": ["age_over_18"],
"country_code": "FR"
}'Todis returns a session identifier and an authorization request to present to your user (QR code or deep link depending on your journey). Their wallet opens it, shows them exactly what is being requested, and sends its response directly to Todis, never to your server.
You then query the session identifier: the response carries a
status ("pending", "verified" or
"failed") and, once verified, the requested
claim:
{
"status": "verified",
"claims": { "age_over_18": true }
}Your application never has to receive or parse a wallet's raw response: it only ever sees this already-verified result.
Direct verification
You've already received your user's proof (SD-JWT VC or mdoc) through some other channel. A single HTTP call gets it verified:
curl -X POST https://verify.todis.eu/verify/sd-jwt-vc \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"presentation": "<proof received from the wallet>",
"country_code": "FR"
}'
country_code lets Todis automatically resolve the
issuer via the EU's official registry. You can also supply its
public key directly with issuer_public_key_pem if
you already know it.
Who decides what gets shared
In a European wallet, each piece of information (age, a degree, a status) is separately protected by its own cryptographic proof. The wallet only attaches to its response the proofs for the information the user agreed to share: everything else stays invisible, not just hidden. Todis technically cannot see it, authorized or not.
With the full flow, you decide what information to ask for,
through the claims field of your request (for
example ["age_over_18"]). Todis passes that request
to the wallet, which shows the user a consent screen listing
exactly the requested information before they accept. With direct
verification, that step has already happened before the proof
reaches Todis: you send us an already-built proof, we verify it
and return its content as is, without adding or removing
anything.
The response
In both cases, you get a clear verification result, with only the
information actually disclosed (see the full flow example above).
Direct verification responds with a verified field:
{
"verified": true,
"claims": { "age_over_18": true }
}Need the full detail?
Response codes and error cases: see the technical reference. Exact request/response schema: todis.eu/en/docs (Swagger). Still have a question? contact@todis.eu.
The flow end to end
Below, an illustrative representation of the complete flow: from the trigger on your side to the value delivered to your customer, not just the part Todis handles.