Unified Authentication & Indian Identity Rails

One API for Developer Auth & Indian Identity

Integrate biometrics, multi-factor authentication, DigiLocker document exchange, and official government credentials into your applications with our modern SDKs.

Modern Authentication

FIDO2 Passkeys, TOTP MFA & Sessions

Empower your users with frictionless sign-in. Support biometric Face ID / Touch ID passkeys, RFC 6238 TOTP authenticator apps, and secure single-use recovery codes. Monitor active device sessions with remote revocation.

Hardware-backed WebAuthn passkeys with device clone detection
AES-256-GCM encrypted TOTP secrets with replay protection
Argon2id password hashing + HaveIBeenPwned breach checking

// Authenticate with Passkey or TOTP

POST /v1/auth/mfa/authenticate

{
  "challengeToken": "ch_984f1a23...",
  "passcode": "482910",
  "clientIp": "103.21.244.2"
}

// 200 OK
{
  "token": "eyJhbGciOiJFZERTQ...",
  "user": {
    "id": "usr_912401...",
    "email": "alex@startup.in",
    "mfaEnabled": true
  }
}

// Create DigiLocker Consent Session

POST /v1/digilocker/sessions

{
  "customerRef": "cust_1048",
  "documents": ["PANCR", "DRVLC", "VEHRC"],
  "redirectUrl": "https://yourapp.in/callback"
}

// 201 Created
{
  "sessionId": "dl_sess_84920...",
  "consentUrl": "https://api.authsetu.com/v1/digilocker/authorize?sess=dl_...",
  "expiresAt": "2026-10-11T16:00:00Z"
}

Digital Locker

Government Document Consent & Retrieval

Authenticate citizens and pull officially verified documents directly from National Digital Locker repositories with tamper-evident digital signatures and user consent.

Hosted DigiLocker OAuth consent screens with mobile responsiveness
XML payload parsing & secure short-lived PDF download URLs
Audited consent timestamps aligned with DPDP Act 2023 regulations

Identity & Business KYC

Instant PAN, DL, RC & GSTIN Checks

Verify customer and vendor authenticity instantly against authorized databases. Validate PAN status, driving licence validity, vehicle registration certificates, and business GSTIN records.

Normalized response schema across all verification types
Automated OCR document parsing and name match confidence scores
Deterministic idempotency keys preventing duplicate billing

// Verify PAN Document

POST /v1/verifications

{
  "type": "pan",
  "documentNumber": "ABCDE1234F",
  "nameToMatch": "Rajesh Kumar",
  "idempotencyKey": "idem_req_77491"
}

// 200 OK
{
  "id": "ver_841029...",
  "status": "verified",
  "nameMatched": true,
  "confidenceScore": 0.98,
  "panType": "Individual"
}

// Webhook Signature Verification

X-AuthSetu-Signature: t=1728662400,v1=5d8f...

// Node.js Webhook Verification
import { verifyWebhookSignature } from '@authsetu/core';

app.post('/webhooks', (req, res) => {
  const isValid = verifyWebhookSignature({
    rawBody: req.rawBody,
    signature: req.headers['x-authsetu-signature'],
    secret: process.env.AUTHSETU_WEBHOOK_SECRET,
  });

  if (!isValid) return res.status(401).send('Invalid signature');
  // Process event safely
  res.sendStatus(200);
});

Real-Time Delivery

HMAC Webhooks & SSRF Protection

Receive real-time notifications for every verification status update, document delivery, and user lifecycle event. Each payload is signed with HMAC-SHA256 and dispatched over bounded exponential retry schedules.

Timestamped HMAC signatures with replay protection
Built-in SSRF DNS guard blocking private & cloud metadata IPs
Detailed delivery logs and manual redelivery in Developer Console

FIDO2 Passkeys, TOTP MFA & Sessions

Hardware-backed WebAuthn passkeys with device clone detection

AES-256-GCM encrypted TOTP secrets with replay protection

Argon2id password hashing + HaveIBeenPwned breach checking

{ "challengeToken": "ch_984f1a23...", "passcode": "482910", "clientIp": "103.21.244.2" } // 200 OK { "token": "eyJhbGciOiJFZERTQ...", "user": { "id": "usr_912401...", "email": "alex@startup.in", "mfaEnabled": true } }

{ "customerRef": "cust_1048", "documents": ["PANCR", "DRVLC", "VEHRC"], "redirectUrl": "https://yourapp.in/callback" } // 201 Created { "sessionId": "dl_sess_84920...", "consentUrl": "https://api.authsetu.com/v1/digilocker/authorize?sess=dl_...", "expiresAt": "2026-10-11T16:00:00Z" }

Government Document Consent & Retrieval

Authenticate citizens and pull officially verified documents directly from National Digital Locker repositories with tamper-evident digital signatures and user consent.

Hosted DigiLocker OAuth consent screens with mobile responsiveness

XML payload parsing & secure short-lived PDF download URLs

Audited consent timestamps aligned with DPDP Act 2023 regulations

Instant PAN, DL, RC & GSTIN Checks

Verify customer and vendor authenticity instantly against authorized databases. Validate PAN status, driving licence validity, vehicle registration certificates, and business GSTIN records.

Normalized response schema across all verification types

Automated OCR document parsing and name match confidence scores

Deterministic idempotency keys preventing duplicate billing

{ "type": "pan", "documentNumber": "ABCDE1234F", "nameToMatch": "Rajesh Kumar", "idempotencyKey": "idem_req_77491" } // 200 OK { "id": "ver_841029...", "status": "verified", "nameMatched": true, "confidenceScore": 0.98, "panType": "Individual" }

// Node.js Webhook Verification import { verifyWebhookSignature } from '@authsetu/core'; app.post('/webhooks', (req, res) => { const isValid = verifyWebhookSignature({ rawBody: req.rawBody, signature: req.headers['x-authsetu-signature'], secret: process.env.AUTHSETU_WEBHOOK_SECRET, }); if (!isValid) return res.status(401).send('Invalid signature'); // Process event safely res.sendStatus(200); });

HMAC Webhooks & SSRF Protection

Timestamped HMAC signatures with replay protection

Built-in SSRF DNS guard blocking private & cloud metadata IPs

Detailed delivery logs and manual redelivery in Developer Console