Direct API Setu Access or Managed DigiLocker Integration

Compare direct and managed DigiLocker integration by asking who owns the provider relationship and each operational task. The answer determines who can resolve access issues, rotate credentials, and account for retained data.

API Setu's consumer process describes a subscription and provider approval. A managed implementation has its own contracts and data flows. Ask the vendor and provider which party may perform each action for your application. API Setu overview API Setu consumer SOP

Use a buyer scorecard

Question	Evidence to ask for
Who holds provider approval?	Named organisation, application, document types, and environment
Who controls the client credentials?	Written custody, rotation, and revocation process
Who receives the raw document?	Data flow covering processors and storage locations
Which checks run?	Field-level result definitions and a synthetic example
Who handles denied consent and outages?	Support responsibilities and escalation route
What happens at contract end?	Deletion process, handover, and continuity plan
What does it cost to operate?	Written charges and your internal engineering and support estimate

Treat “supports DigiLocker” as a starting point. Ask the provider which particular workflow and evidence checks the offer covers.

Compare two practical arrangements

In a direct arrangement, the applicant manages the approved provider relationship. Its engineers operate the integration, handle failures, and keep the configuration current. This can fit a team with the capacity to run the complete workflow.

A vendor can host part of an approved workflow or support it with client-owned credentials. Managed credentials are another arrangement where the contracts permit them. Identify the exact model because the boundaries differ.

For example, a rental platform already holds approved requester credentials. It wants help with a hosted journey. Ask who receives the document, where the result resides, and who can revoke the grant. Those answers matter more than the label on the service.

Estimate operating costs

List setup work, access review, provider charges under the applicable terms, and ongoing operations. Include consent redesign, credential rotation, monitoring, and periodic security review. Ask how retry attempts and incomplete cases affect any charges.

Set a time horizon and use the same volume assumptions for each option. If a quote omits a term, leave that item open until you have it in writing.

Test the exit path

Give each option the same scenario. A customer ends an agreement while a verification remains open. Ask who cancels the request, revokes the grant, and removes retained results. Ask how the customer confirms completion.

Record these answers before you rely on either route. Production readiness worksheet.

Compare arrangements with NamoID

NamoID engineers can discuss the controlled driving licence preview and its approval boundaries. Bring your proposed credential arrangement and required result fields. The team can help you assess responsibilities before you choose an integration route. Message the NamoID team in Slack