Integrated Indian identity Verification via DigiGo

[VampishWolf]

What

Adds Verify via DigiGo next to Verify via Self on the India Resident card. Second door to the same voucher pool — the Self flow is untouched.

DigiGo runs UIDAI's Aadhaar app flow (QR + face auth) and returns a signed credential asserting only Indian / not Indian. No Aadhaar number, name, DOB or photo reaches Devcon.

Built on @digigo/verify.

How

Modal opens a session via /api/tickets/digigo-session — the only place DIGIGO_API_KEY is used, server-side. Attendee scans the QR; the credential's proof goes to /api/tickets/redeem-digigo, which verifies it against DigiGo's public JWKS (the client's publicSignals are never read). Indian + 18+ → voucher → Pretix redeem link.

Both routes call the SDK directly rather than using its drop-in handlers, which are Web-standard Request → Response and don't fit Pages Router.

Screenshots

1. Verify via DigiGo CTA

2. QR Modal Open

3. Indian Identity successfully verified

PoC Video Link

https://drive.google.com/file/d/1kQ32RERyYChLw4lDl23xs5HwgVrwa1fu/view?usp=drive_link

Notes for review

• The QR flow is split into an inner component so it mounts only when the modal opens — sessions are metered, and an always-mounted hook would open one per store visitor.
• Vouchers are keyed digigo:<nullifier> (a per-event pseudonym, not an identity) — one claim per Aadhaar identity.
• The 18+ gate fails closed (ageAbove18 !== true), matching Self. A null age would otherwise leave the check silently doing nothing.
• Styles are additive; the footer-wrap modifier applies only to this one card.

Before launch

• Set DIGIGO_API_KEY in Netlify. Until then the card shows "Verification unavailable".
• Cross-provider dedup: Self and DigiGo nullifiers can't be linked, so one person can claim through both. Needs a shared key (email, or a Pretix limit) if that matters.

Testing

tsc --noEmit clean. Modal verified against live DigiGo: session opened, QR rendered, countdown running; two columns on desktop, QR above steps on mobile. Redeem route rejects missing/tampered credentials. Voucher issuance not exercised end to end — needs a real Aadhaar scan against a configured key.

[netlify]

‼️ Deploy request for devcon-app rejected.

Name	Link
🔨 Latest commit	df9fea8

[netlify]

‼️ Deploy request for devconnect-monorepo rejected.

Name	Link
🔨 Latest commit	df9fea8

[netlify]

👷 Deploy request for devcon-social pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	df9fea8

[netlify]

‼️ Deploy request for devconnect-pwa rejected.

Name	Link
🔨 Latest commit	df9fea8

[netlify]

‼️ Deploy request for devcon-monorepo rejected.

Name	Link
🔨 Latest commit	df9fea8

[netlify]

‼️ Deploy request for devcon-event-app rejected.

Name	Link
🔨 Latest commit	df9fea8

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​digigo/​verify@​0.1.4

View full report

[didierkrux]

Thanks for putting this together, @VampishWolf, and for the care that went into the PoC.

I replied by email with where we landed for Devcon 8, so I am closing this here. Appreciate the contribution 🙏