README

A Laravel package for integrating with AltID — Danmarks officielle app til digitalt ID og aldersverifikation.

AltID is a digital identity wallet built on the eIDAS2 regulation, enabling citizens to securely share verified credentials. This package implements the OID4VP (OpenID for Verifiable Presentations) flow with mdoc/ISO 18013-5 credentials to receive age verification responses from the AltID app.

Note: This package currently only supports age verification. Support for full digital ID (identification) is planned for a future release.

Requirements

• PHP 8.4+
• Laravel 11, 12 or 13
• A cache driver (Redis recommended for production)

Installation

composer require lenius/laravel-altid

Publish the config file:

php artisan vendor:publish --tag="laravel-altid-config"

Optionally publish views and assets:

php artisan vendor:publish --tag="laravel-altid-views"
php artisan vendor:publish --tag="laravel-altid-assets"

Configuration

Key environment variables:

# The age claim to verify (default: age_over_18)
ALTID_AGE_CLAIM=age_over_18

# Transaction TTL in minutes (default: 15)
ALTID_TRANSACTION_TTL_MINUTES=15

# AltID deep-link scheme (default: av://)
ALTID_SCHEME=av://

# mdoc doctype
ALTID_DOCTYPE=eu.europa.ec.av.1
ALTID_NAMESPACE=eu.europa.ec.av.1

# Trust anchor certificate fingerprint(s), comma-separated
ALTID_TRUST_ANCHOR_FINGERPRINTS=1dc89e870cddac990f5585a0265568522531af678592cc73effd9f8706f55995

# Set true only during development to skip cryptographic verification
ALTID_ACCEPT_UNVERIFIED_RESPONSES=false

# Require device binding in the mdoc proof
ALTID_REQUIRE_DEVICE_BINDING=false

# Disable built-in web demo/info routes (/altid, /alderstjek)
ALTID_REGISTER_WEB_ROUTES=true

Supported age claims:

Routes

The package registers the following routes automatically:

API routes (/api)

Web routes

Usage

Start an age verification

use Lenius\LaravelAltid\AltIdAgeVerificationService;

$service = app(AltIdAgeVerificationService::class);

// Start with default claim (age_over_18)
$transaction = $service->start();

// Or specify a claim
$transaction = $service->start('age_over_21');

The returned array contains:

[
    'transaction_id'        => 'abc123',
    'authorization_url'     => 'av://?response_type=vp_token&...',  // deep-link for AltID app
    'test_app_url'          => 'https://app.test.tegnebog.dk/...',  // for testing
    'status_url'            => 'https://yourapp.com/api/altid/age/abc123/status',
    // ...
]

Present the authorization_url as a QR code or deep-link button so the user can open it in the AltID app.

Poll for result

$transaction = $service->find($transactionId);

// $transaction['status']   => 'pending' | 'approved' | 'failed'
// $transaction['verified'] => true | false

Testing

Request test access by emailing AltID@digst.dk with subject line Testadgang til AltID.

The test tool is available at test-tool.test.tegnebog.dk.

Set ALTID_ACCEPT_UNVERIFIED_RESPONSES=true in your .env during development to bypass cryptographic verification.

composer test

AltID Resources

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Carsten Jonstrup
• All Contributors

License

The MIT License (MIT). Please see License File for more information.