KeyShare Digital ID Platform.
Credential issuance. Verification. Trust governance. Workflow orchestration. Sovereign deployment. Offline-first.
Not a technical evaluator? Start here.
The Digital ID Platform is the technology foundation behind the KeyShare for Government solution. This page is for technical teams evaluating the platform's architecture, components, and integration model. For the business case — sovereign ownership, offline-first verification, workflow-driven ecosystems, and deployment partnerships — visit the Government Solution page.
The sovereign credential infrastructure for national identity ecosystems.
The KeyShare Digital ID Platform is a modular, sovereign-deployable platform for national-scale credential ecosystems. It handles the full credential lifecycle — issuance, presentation, verification, revocation, backup, and recovery — across multiple credential formats, multiple verification modalities, and multiple deployment topologies.
The platform comprises seven core services organized in a three-layer architecture with clear ownership boundaries between the government, the deployment partner, and KeyShare. Open standard interfaces at every layer boundary ensure no vendor lock-in at any level of the stack.
The platform is not a wallet. It is not an issuance engine. It is the complete infrastructure layer that connects issuers, holders, and verifiers within a governed trust framework — and enables any organization to participate through a standard integration model.
Three-layer architecture. Clear ownership boundaries.
The platform is structured in three layers, each with distinct ownership, deployment, and auditability characteristics.
Why this layering matters
Clear ownership
The government owns and operates the service and application layers. KeyShare maintains the platform layer.
Independent audit
The government's CISO can scope an audit at the application and service layers without requiring access to cryptographic implementations.
Vendor replaceability
Open standard interfaces between layers mean any layer can be replaced independently without rebuilding the stack.
Seven services. One governed ecosystem.
Credential Issuance Engine
Issues verifiable credentials to citizens on behalf of authorized organizations. Multi-format: W3C VC, SD-JWT, mDoc.
Verification Engine
Verifies credential presentations — online or offline. Three modalities: QR, NFC/BLE, barcode. Under 2 seconds offline.
Trust Governance Service
Manages the trust framework — who can issue, who can verify, under what policies, with what attestations.
Workflow Engine
Zero-code extensibility. New credential types and organization interactions without platform code changes.
Holder Agent Service
Manages the citizen's credential wallet — storage, presentation, backup, recovery, and delegated access.
Integration Bridge
Connects external organizations — government agencies, banks, hospitals, universities — to the platform ecosystem.
Message Routing Service
DIDComm v2 encrypted messaging between platform components and between organizations and citizen wallets.
Ecosystem Management Portal
Web-based administration for trust framework management, ecosystem governance, and platform monitoring.
Credential Issuance Engine
Issues verifiable credentials to citizens on behalf of authorized organizations.
Capabilities
- Multi-format issuance: W3C Verifiable Credentials (v1.1/v2.0), SD-JWT VC, ISO 18013-5 mDoc
- Protocol: OIDC4VCI (OpenID for Verifiable Credential Issuance)
- Batch issuance for population-scale programs
- Credential schema management — define, version, and publish
- Issuer authorization enforcement via trust chain attestations
- Supports deferred issuance (credential preparation before citizen enrollment)
Interfaces
- → Trust Governance Service
- → Holder Agent Service
- → Workflow Engine
Verification Engine
Verifies credential presentations from citizens — online or offline.
Capabilities
- Multi-format verification: W3C VP, SD-JWT presentation, mDoc device retrieval
- Protocol: OIDC4VP (OpenID for Verifiable Presentations)
- Three offline modalities: QR scan, NFC/BLE proximity, high-density barcode
- Offline verification in under 2 seconds — no network round-trip
- Automated verification terminals (RP Mode): unattended, no human operator
- Selective disclosure enforcement
- Revocation status checking (online: real-time; offline: cached status list)
Interfaces
- → Trust Governance Service
- → Credential Issuance Engine
Trust Governance Service
Manages the trust framework — who can issue, who can verify, under what policies.
Capabilities
- Hierarchical trust chains: root authority → intermediate → issuers/verifiers
- Verifiable accreditations: machine-readable attestations
- Machine-readable governance policies with automated enforcement
- Attestation lifecycle management: issue, renew, revoke, suspend
- Trust framework versioning and migration
- Based on the EBSI trust chain model, adapted for multi-country deployment
Interfaces
- → Credential Issuance Engine
- → Verification Engine
- → Ecosystem Management Portal
Workflow Engine
Zero-code extensibility — new credential types and organization interactions without platform code changes.
Capabilities
- Workflow definition: schema + rules + consent steps + format + delivery channel
- Runtime workflow rendering in the citizen wallet — no wallet update required
- Event-driven, scheduled, or manual trigger conditions
- Multi-step workflows with conditional branching
- Workflow versioning with backward compatibility
- Organization-defined workflows deployed independently
Interfaces
- → Credential Issuance Engine
- → Holder Agent Service
- → Integration Bridge
Holder Agent Service
Manages the citizen's credential wallet — storage, presentation, backup, recovery, and delegated access.
Capabilities
- Credential storage with device-level encryption (iOS Keychain / Android Keystore)
- Selective disclosure: citizen controls which claims to share
- Consent management: explicit citizen approval before every share
- Backup and recovery: encrypted cloud backup with citizen-controlled recovery keys
- Delegated Agent Mode: authorized field agents facilitate operations on behalf of citizens without smartphones
- Custodian wallet model: institutional credential management for assisted access
Interfaces
- → Credential Issuance Engine
- → Verification Engine
- → Workflow Engine
- → Mobile SDKs
Organization Integration Bridge
Connects external organizations to the platform ecosystem.
Capabilities
- Standardized integration specification
- REST API with webhook callbacks for event-driven integration
- Pre-built adapters for common systems (civil registries, health info systems, core banking)
- Organization-scoped configuration: credential types, workflows, data mapping
- Independent deployment: each organization deploys its own bridge instance
- No platform changes required when a new organization connects
Interfaces
- → Workflow Engine
- → Credential Issuance Engine
- → Trust Governance Service
Message Routing Service
Routes encrypted messages between platform components and between organizations and citizen wallets.
Capabilities
- Protocol: DIDComm v2
- End-to-end encrypted messaging between any two platform participants
- Store-and-forward for offline participants
- Message priority and delivery guarantees
- Supports real-time and asynchronous communication patterns
Interfaces
- → All services (inter-service)
- → Holder Agent Service
- → Integration Bridge
Ecosystem Management Portal ADMINISTRATION
Web-based administration interface for trust framework management, ecosystem governance, and platform monitoring.
Capabilities
- Organization onboarding: register, issue attestations, assign permissions
- Credential schema governance: define, version, publish, deprecate
- Trust framework administration: trust chains, policies, hierarchies
- Platform monitoring: service health, issuance volumes, verification activity
- Audit log access: searchable event log for compliance and investigations
- Role-based access control for platform administrators
Interfaces
- → Trust Governance Service
- → Credential Issuance Engine
- → All services (monitoring)
Full credential lifecycle. Six stages.
Schema Definition
Organization defines credential schema — data fields, format, validation rules, consent requirements. Published to the trust framework.
Trust Governance · Workflow Engine
Issuance
Authorized organization issues credential to citizen via OIDC4VCI. Multi-format: same data, different container depending on use case.
Issuance Engine · Holder Agent
Storage
Credential stored in citizen's wallet with device-level encryption. Encrypted cloud backup. Citizen holds the cryptographic keys.
Holder Agent · Mobile SDKs
Presentation
Citizen presents credential to verifier with selective disclosure. Three offline modalities: QR, NFC/BLE, barcode. Protocol: OIDC4VP.
Verification Engine · Holder Agent
Verification
Verifier checks signature chain, revocation status, policy compliance, issuer authorization. Online: real-time. Offline: sub-2-second.
Verification Engine · Trust Governance
Revocation / Suspension
Issuing organization revokes or suspends a credential. Status propagated to verifiers. Online: immediate. Offline: next sync cycle.
Issuance Engine · Holder Agent
Additional lifecycle operations: Credential renewal, backup and recovery (citizen restores to new device), and credential portability (standard export formats for wallet migration).
Offline-first — not offline-capable.
Designed for environments where network connectivity is intermittent or absent. Offline operation is a core architectural capability, not a degraded mode.
How offline verification works
Trust data pre-loading
When online, the device downloads revocation status lists, issuer public keys, governance policies, and verifier authorization. Cryptographically signed and time-stamped.
Autonomous operation
Offline, the device verifies using cached trust data: signature validation, revocation check, issuer authorization, and policy compliance. All local — no network round-trip.
Sub-2-second verification
Offline verification completes in under 2 seconds across all three modalities (QR, NFC/BLE, barcode). No server contact required.
72-hour tolerance window
Devices operate autonomously for up to 72 hours offline (configurable). Higher-security deployments set shorter windows; low-connectivity environments can extend.
Incremental re-sync
When connectivity returns, only changed trust data is downloaded — not the full package. Automatic and transparent to the operator.
Offline capability by component
Three deployment topologies. One platform.
Single Sovereign Data Center
Countries with reliable national infrastructure, single operational team.
Simplest to operate. Single point of administration. All services co-located.
Regional Data Centers
Large countries with regional governance, distributed operations.
Regional autonomy with central trust governance. Each region operates independently; trust synchronized centrally.
Core + Edge
Countries with urban connectivity but rural gaps.
Issuance and trust governance centralized; verification terminals at edge locations with offline capability.
Shared deployment characteristics
Sovereign infrastructure: Deploys within the government's own servers. KeyShare does not host production.
Container-based: Docker/OCI containers on Kubernetes. Infrastructure-agnostic.
Configuration-driven: Country-specific parameters without code changes.
Government-controlled updates: Review, stage, deploy. No automatic updates to production.
Deployed by certified regional partners
In the Global South and emerging markets, the KeyShare Digital ID Platform is deployed exclusively through certified deployment partners. These partners customize the platform for local regulatory requirements, integrate with national systems, and provide in-country implementation support. KeyShare provides the technology — our partners deliver the solution.
Connect with your regional partner →Any organization connects. No platform changes required.
The ecosystem grows without platform releases. New organizations deploy an Integration Bridge that connects their existing systems.
API surface
Integration timeline (typical)
Native SDKs for Android and iOS.
Build country-branded wallet applications without implementing cryptographic protocols from scratch.
SDK modules
Android
- Language: Kotlin
- Minimum OS: Android 8.0 (API 26)
- Storage: Android Keystore (hardware-backed)
- Biometric: BiometricPrompt API
iOS
- Language: Swift
- Minimum OS: iOS 15.0
- Storage: iOS Keychain (Secure Enclave)
- Biometric: LocalAuthentication / LAContext
Reference wallet: Full source code provided. Partners customize UI, branding, language, and onboarding. Credential handling logic stays with the SDK to ensure cryptographic correctness.
Security architecture for citizen-scale data.
Data flow and minimization
Key management
- HSM integration for all platform-level cryptographic operations
- Citizen keys generated and stored in device secure element (hardware-backed)
- Key hierarchy: platform root keys (HSM) → service signing → organization signing → citizen keys
- Root key ceremony performed under government supervision
- Non-exportable keys at every level — keys never exist outside secure hardware unencrypted
- Key rotation supported at all levels with defined migration procedures
Compliance alignment
Code auditability: Application and service layer source code provided for government security audit with each release.
Penetration testing: Isolated staging environments provisioned for independent security assessment.
Zero-trust design: Zero-trust principles in platform architecture with comprehensive audit trail.
Vulnerability disclosure: Responsible reporting program for security researchers and government audit teams.
Standards at every layer.
8 protocol and format standards + 3 framework alignments.
Technical specifications.
Platform
Performance targets
Developer resources for deployment partners.
API Reference
OpenAPI (Swagger) specification for all platform APIs.
Partner accessSDK Documentation
Integration guides for Android and iOS SDKs — module-level documentation and code samples.
Partner accessReference Wallet Source
Full source code for Android and iOS reference wallet applications.
With SDK packageIntegration Guide
Step-by-step bridge deployment — from attestation request to first credential issuance.
Partner accessSandbox Environment
Isolated staging for integration testing — pre-configured trust framework, sample orgs, test credentials.
Per partnerGovernment Tech Overview
Architecture overview, standards compliance, security posture, deployment options (PDF).
Upon requestFor developer documentation access, deployment partners should contact their KeyShare technical liaison or request a partner briefing.
Frequently asked questions.
Ready for a technical deep dive?
Request a government briefing to discuss architecture, deployment topologies, integration requirements, and security audit scoping. We'll connect you with the right technical team for your region.