# Changelog

Changes to Digital ID that affect merchant integrations. Entries are listed
newest first, by the date of publication in this documentation. Review the
integration steps before you change your integration.

<div className="privy-changelog-timeline">

<section className="privy-changelog-entry" aria-label="One verification flow — latest change">

<span className="privy-changelog-badge">Latest</span>

## 22 October 2026: One verification flow for both data packages

**Breaking change** · **Announcement date:** 22 October 2026 · **Effective date:** 22 October 2026

Both data packages now use the same verification flow. The user can enter any
supported identifier, and OTP follows the face match for both packages. The
consent screen has a confirmation window. This release also corrects the JWT
issuer value and the sandbox hosts in the examples.

The API version 1.0.0 endpoints, request fields, and response fields did not
change.

### What changed

| Area | Before | Now |
| --- | --- | --- |
| User input | Contact package: phone number. Identity package: PrivyID or NIK. | Both packages: PrivyID, email, NIK, or mobile number. Indonesian and international mobile numbers are supported. |
| OTP | Identity package only. | Both packages, after the face match. WhatsApp is the default channel. |
| Blocked session | Three failed liveness attempts. | Three failed liveness or face-match attempts. |
| Consent | No confirmation window was documented. | The user must respond within the confirmation window. The default is 5 minutes. When the window ends, the session expires and the widget sends `privy:error` with `session_expired`. |
| JWT `iss` claim | `https://digitalid.privy.id` | `https://digitalid.privy.id/`, with a trailing slash |
| Sandbox hosts in the quickstart and web integration examples | `https://sandbox-api-digitalid.privy.id` and `https://sandbox-digitalid.privy.id` | `https://stg-api-digitalid.privy.id` and `https://stg-digitalid.privy.id` |

### Documentation changes

- "Credential types" is now "data packages". The Credential Types page moved
  from `/digital-id/concepts/credential-types` to
  [Data Packages](/digital-id/concepts/data-packages).
- New pages: [User Journey](/digital-id/concepts/user-journey),
  [Session Lifecycle](/digital-id/concepts/session-lifecycle),
  [Privy Button](/digital-id/guides/privy-button),
  [Server Callback](/digital-id/guides/server-callback),
  [Production Readiness](/digital-id/guides/production-readiness),
  [API Limitations](/digital-id/api-reference/limitations), and
  [Glossary](/digital-id/api-reference/glossary).
- The [Error Catalog](/digital-id/api-reference/errors#recovery-guide) has a
  recovery guide.
- The entry point to the widget uses a button such as **Login with PrivyID**.
  The button text must include "with PrivyID".

### New integrations

Follow the [quickstart](/digital-id/get-started/quickstart). Before you go
live, complete the
[production readiness](/digital-id/guides/production-readiness) checklist.

### Existing integrations

1. Change the `iss` check of your JWT verification to
   `https://digitalid.privy.id/`, with the trailing slash. See
   [Verify the JWT](/digital-id/guides/verify-jwt).
2. If your integration uses a `sandbox-` host, change it to the `stg-` host in
   the table above. Also change the `event.origin` check of your widget event
   listener.
3. Handle the end of the consent confirmation window. When the widget sends
   `privy:error` with `session_expired`, close the widget and offer a new
   session.
4. Contact package: the widget now shows the OTP step and accepts all
   identifier types. No API change is necessary.
5. Change links to the Credential Types page to
   [Data Packages](/digital-id/concepts/data-packages).

</section>

<section className="privy-changelog-entry" aria-label="JWT issuer change">

## 21 August 2026: JWT issuer change

**Breaking change** · **Announcement date:** 21 August 2026 · **Effective date:** 21 August 2026

The `iss` claim of the verified-data JWT changed.

| Previous `iss` | New `iss` |
| --- | --- |
| `https://id.privy.id` | `https://digitalid.privy.id` |

On 22 October 2026, the documented value was corrected to
`https://digitalid.privy.id/`, with a trailing slash. See the
[22 October 2026 entry](#22-october-2026-one-verification-flow-for-both-data-packages).

### Existing integrations

Change the `iss` check of your JWT verification to
`https://digitalid.privy.id/`. Then verify a sandbox token.

</section>

<section className="privy-changelog-entry" aria-label="Sandbox base URL change">

## 10 August 2026: Sandbox base URLs

**Breaking change (sandbox only)** · **Announcement date:** 10 August 2026 · **Effective date:** 10 August 2026

The sandbox API and widget base URLs changed. The production base URLs did not
change.

| Base URL | Previous sandbox host | New sandbox host |
| --- | --- | --- |
| API | `https://sandbox-api-digitalid.privy.id` | `https://stg-api-digitalid.privy.id` |
| Widget | `https://sandbox-digitalid.privy.id` | `https://stg-digitalid.privy.id` |

### Existing integrations

Change the sandbox API host and the sandbox widget origin in your
configuration and in your `event.origin` check. See
[Environments](/digital-id/concepts/environments).

</section>

<section className="privy-changelog-entry" aria-label="Digital ID API 1.0.0 — initial release">

## 31 July 2026: Digital ID API 1.0.0

**`1.0.0`** · Initial release

First publication of the Digital ID documentation for API version 1.0.0. It
covers session creation, widget embedding in an iframe or a native WebView,
result delivery by exchange code and server callback, JWT verification, and
encrypted identity data.

</section>

</div>