Skip to main content
Webhooks are event-based notifications that are received when a specific event related to the DigiLocker verification occurs.
In rare cases, such as network retries, read timeouts, processing delays, or delivery failures, the same webhook might be sent more than once for the same event. To prevent unintended side effects, implement idempotency in your webhook handler to handle duplicate deliveries.

​
Add webhooks

Add your webhook URL in our system for us to deliver webhook events. Follow the instructions below to configure the webhook URL. Ensure to provide the publicly accessible HTTPS URL to your webhook endpoint.
  1. Log in to the Merchant Dashboard and click Developers.
  2. Click Webhooks listed under the Secure ID card.
  3. Click Add Webhook URL in the Webhook screen.
  4. In the Add Webhook popup, enter the webhook URL.
  5. Click Test & Add Webhook.

Add Webhook

​
Webhook signature

You will receive the webhook signature in the webhook header. Here is a sample header from a webhook request.
Header NameHeader Value
content-length1099
x-webhook-attempt1
content-typeapplication/json
x-webhook-signature07r5C3VMwsGYeldGOCYxe5zoHhIN1zLfa8O0U/yngHI=
x-webhook-timestamp1746427759733
Always capture the webhook payload in its raw text format before parsing into JSON. Parsing and reserialising the payload can change the structure (for example, array ordering, spacing, or null handling) and cause a signature mismatch during verification. Use the exact raw body string from the request when computing the signature.

​
Webhook event

Event TypeDescription
DIGILOCKER_VERIFICATION_SUCCESSTriggered when the user’s DigiLocker verification is successfully completed.
DIGILOCKER_VERIFICATION_LINK_EXPIREDTriggered when the DigiLocker URL expires due to user inaction.
DIGILOCKER_VERIFICATION_CONSENT_DENIEDTriggered when the user denies consent for DigiLocker verification.
DIGILOCKER_VERIFICATION_CONSENT_EXPIREDTriggered when the user’s document consent for DigiLocker verification expires, which occurs 1 hour after the user grants consent.
DIGILOCKER_VERIFICATION_FAILURETriggered when the DigiLocker verification fails due to a system error.

​
Sample webhook events

The following are examples of webhook events that you may receive. 
{
   "event_type":"DIGILOCKER_VERIFICATION_SUCCESS",
   "event_time":"2006-01-02T15:04:05Z",
   "version":"v1",
   "data":{
        "user_details": {
            "name": "John Doe",
            "dob": "02-02-1995",
            "gender": "M",
            "eaadhaar": "Y",
            "mobile": "9999999999"
        },
        "status": "AUTHENTICATED",
        "document_requested": [
            "AADHAAR",
            "PAN",
            "DRIVING_LICENSE"
        ],
        "document_consent": [
            "AADHAAR",
            "PAN",
            "DRIVING_LICENSE"
        ],
        "verification_id": "ABC00123",
        "reference_id": 12345
    }
}

​
Webhook payload fields

The webhook payload contains important metadata in its top-level fields.
FieldTypeDescription
event_typestringIndicates the type of event that triggered the webhook.
event_timestringThe UTC timestamp of when the event occurred, formatted in ISO 8601 (YYYY-MM-DDTHH:MM:SSZ).
versionstringIndicates the webhook format being used. Default version is “v1”.
dataobjectContains event-specific details related to this feature.
Verifying the signature is mandatory before processing any response.

​
Signature Verification

Every DigiLocker webhook contains a signature (x-webhook-signature) in the header. The verification process is as follows:
  1. Extract the x-webhook-timestamp from the headers.
  2. Concatenate the timestamp and the raw request body (exact payload, unmodified).
  3. Generate an HMAC-SHA256 hash of this string using your client secret.
  4. Base64-encode the hash.
  5. Compare it with the x-webhook-signature header value. If they match, the webhook is valid.
  • Always use the raw request body and not a parsed JSON object. This prevents signature mismatch.
  • Reject the webhook if the signature does not match.

​
Sample Code

const crypto = require("crypto");

function verify(req) {
  const ts = req.headers["x-webhook-timestamp"];
  const rawBody = req.rawBody; // middleware must store raw body
  const secretKey = "<client-secret>";
  const signStr = ts + rawBody;
  return crypto.createHmac("sha256", secretKey).update(signStr).digest("base64");
}
⌘I