DigiLocker API Integration for KYC: Process and Pricing

DigiLocker has two kinds of partners. Issuers, such as UIDAI, the Income Tax Department, transport departments and education boards, publish documents into it. Requesters are organisations that ask users to share documents. For KYC you integrate as a requester.

The integration follows the OAuth 2.0 authorisation code pattern.

Always exchange the code and fetch documents from your server. The client secret never belongs in a mobile app.

Under the Information Technology rules governing digital locker facilities, documents issued through DigiLocker are to be treated on par with original physical documents. RBI's KYC rules recognise documents obtained through DigiLocker as a form of officially valid document, and SEBI and IRDAI accept them for onboarding in their sectors. Confirm the specific wording for your regulator and product.

There are two ways to integrate.

The cost most businesses see is the aggregator's fee, typically a few rupees per successful document pull, falling with volume and often bundled with PAN, bank account and face match checks. Direct requester access is governed by the DigiLocker partner terms in force at the time you apply; check the partner portal for current charges, as terms have changed over time. Include the cost of failed and abandoned sessions when comparing providers.

Not every user has a DigiLocker account or a mobile number linked to Aadhaar, so keep a fallback such as offline Aadhaar verification or document upload with video KYC. Ask only for the documents you need. Store the signed XML as evidence, restrict access, and apply retention rules under the DPDP Act and your sector regulator.