Changelog
Changes to Digital ID that affect merchant integrations. Entries are listed newest first, by the date of publication in this documentation. Review the integration steps before you change your integration.
22 October 2026: One verification flow for both data packages
Breaking change · Announcement date: 22 October 2026 · Effective date: 22 October 2026
Both data packages now use the same verification flow. The user can enter any supported identifier, and OTP follows the face match for both packages. The consent screen has a confirmation window. This release also corrects the JWT issuer value and the sandbox hosts in the examples.
The API version 1.0.0 endpoints, request fields, and response fields did not change.
What changed
| Area | Before | Now |
|---|---|---|
| User input | Contact package: phone number. Identity package: PrivyID or NIK. | Both packages: PrivyID, email, NIK, or mobile number. Indonesian and international mobile numbers are supported. |
| OTP | Identity package only. | Both packages, after the face match. WhatsApp is the default channel. |
| Blocked session | Three failed liveness attempts. | Three failed liveness or face-match attempts. |
| Consent | No confirmation window was documented. | The user must respond within the confirmation window. The default is 5 minutes. When the window ends, the session expires and the widget sends privy:error with session_expired. |
JWT iss claim | https://digitalid.privy.id | https://digitalid.privy.id/, with a trailing slash |
| Sandbox hosts in the quickstart and web integration examples | https://sandbox-api-digitalid.privy.id and https://sandbox-digitalid.privy.id | https://stg-api-digitalid.privy.id and https://stg-digitalid.privy.id |
Documentation changes
- "Credential types" is now "data packages". The Credential Types page moved
from
/digital-id/concepts/credential-typesto Data Packages. - New pages: User Journey, Session Lifecycle, Privy Button, Server Callback, Production Readiness, API Limitations, and Glossary.
- The Error Catalog has a recovery guide.
- The entry point to the widget uses a button such as Login with PrivyID. The button text must include "with PrivyID".
New integrations
Follow the quickstart. Before you go live, complete the production readiness checklist.
Existing integrations
- Change the
isscheck of your JWT verification tohttps://digitalid.privy.id/, with the trailing slash. See Verify the JWT. - If your integration uses a
sandbox-host, change it to thestg-host in the table above. Also change theevent.origincheck of your widget event listener. - Handle the end of the consent confirmation window. When the widget sends
privy:errorwithsession_expired, close the widget and offer a new session. - Contact package: the widget now shows the OTP step and accepts all identifier types. No API change is necessary.
- Change links to the Credential Types page to Data Packages.
21 August 2026: JWT issuer change
Breaking change · Announcement date: 21 August 2026 · Effective date: 21 August 2026
The iss claim of the verified-data JWT changed.
Previous iss | New iss |
|---|---|
https://id.privy.id | https://digitalid.privy.id |
On 22 October 2026, the documented value was corrected to
https://digitalid.privy.id/, with a trailing slash. See the
22 October 2026 entry.
Existing integrations
Change the iss check of your JWT verification to
https://digitalid.privy.id/. Then verify a sandbox token.
10 August 2026: Sandbox base URLs
Breaking change (sandbox only) · Announcement date: 10 August 2026 · Effective date: 10 August 2026
The sandbox API and widget base URLs changed. The production base URLs did not change.
| Base URL | Previous sandbox host | New sandbox host |
|---|---|---|
| API | https://sandbox-api-digitalid.privy.id | https://stg-api-digitalid.privy.id |
| Widget | https://sandbox-digitalid.privy.id | https://stg-digitalid.privy.id |
Existing integrations
Change the sandbox API host and the sandbox widget origin in your
configuration and in your event.origin check. See
Environments.
31 July 2026: Digital ID API 1.0.0
1.0.0 · Initial release
First publication of the Digital ID documentation for API version 1.0.0. It covers session creation, widget embedding in an iframe or a native WebView, result delivery by exchange code and server callback, JWT verification, and encrypted identity data.