Verify with Google Wallet supports three integration paths---two **online** paths
(for Android apps and websites) and one **in-person** path (for proximity
readers and point-of-sale terminals). Select your path to get started.

## The three integration paths

Online • Direct integration

### Relying Party (RP)

For **individual merchants, businesses, or app developers** verifying users directly for **their own** website or Android app.
![Direct Relying Party 1:1 model where Google CA signs your certificate](https://developers.google.com/static/wallet/identity/images/verify-path-rp.png) [View Relying Party Integration Guide](https://developers.google.com/wallet/identity/verify/choose-your-path?tab=relying-parties-direct#relying-party-roadmap) Online • IDV / aggregator

### Verifier Registrar (VR)

For **IDV providers, aggregators, or platforms** verifying users **on behalf of multiple downstream businesses** (End RPs).
![Verifier Registrar 1:N CA model where your Root CA issues leaf certificates for downstream merchants](https://developers.google.com/static/wallet/identity/images/verify-path-vr.png) [View Verifier Registrar Integration Guide](https://developers.google.com/wallet/identity/verify/choose-your-path?tab=verifier-registrars-aggregators#verifier-registrar-roadmap) In person • Proximity

### In-person verification

For **point-of-sale terminals, venue readers, or mobile verifier apps** verifying mDLs offline---works without Google allowlisting if your terminal supports ISO/IEC 18013-5 mdoc retrieval (ID passes are not currently supported in person).
![In-person POS reader verifying Google Wallet over NFC or QR and BLE](https://developers.google.com/static/wallet/identity/images/verify-path-inperson.png) [Go to In-Person Guide →](https://developers.google.com/wallet/identity/verify/accepting-ids-from-wallet-offline)

## Compare online paths: Relying Party vs. Verifier Registrar

| Aspect | Relying Party (RP) | Verifier Registrar (VR) |
|---|---|---|
| **Who signs requests** | Google signs your certificate (you submit a CSR) | You run your own CA (Sandbox + Production Root CAs) and sign leaf certificates for End RPs |
| **Sandbox credentials** | Google's shared [sandbox test keys \& metadata](https://developers.google.com/wallet/identity/verify/sandbox#testing-signed-requests) (start testing immediately) | Certificates signed by your own Sandbox Root CA, after Google trusts it |
| **When to contact Google** | At the **end** (Step 5), after completing sandbox testing | At the **start** (Step 1), to register your Sandbox \& Production Root CAs |

## Online integration guide

Select your online integration path to follow Steps 1 through 5 in order.
You can complete Steps 1 and 2 (sandbox and test ID setup) in parallel while
your engineering team builds Step 3.

### Relying Parties (Direct)

1

#### Set up the sandbox

**No intake form or approval is needed to start testing.** Request sandbox allowlisting for your test Google Account, switch a test Android device to sandbox mode, and download Google's shared sandbox test keys and the Utopia Sandbox cert.
[Step 1: Set up the sandbox](https://developers.google.com/wallet/identity/verify/sandbox) [Get sandbox test keys](https://developers.google.com/wallet/identity/verify/sandbox#testing-signed-requests) 2

#### Create a test ID in the sandbox

Use a second Android device running the Utopia ePassport Simulator to provision a simulated **ID pass** into Google Wallet on your sandbox device.
[Step 2: Create a test ID](https://developers.google.com/wallet/identity/verify/create-test-id) 3

#### Integrate as a Relying Party

Follow the four implementation steps in the Relying Party integration guide:

- **Step 3.A --- Format \& sign the request:** Build the OpenID4VP JSON query and sign the JWS on your server.
- **Step 3.B --- Trigger the API:** Call Android `CredentialManager` or Web `navigator.credentials.get()`.
- **Step 3.C --- Decrypt \& validate the response:** Decrypt the JWE and verify the IACA certificate chain and MSO on your server.
- **Step 3.D (Optional) --- Add Zero-Knowledge Proofs:** Verify age predicates without receiving the user's birthdate.

[Step 3: Integrate as a Relying Party](https://developers.google.com/wallet/identity/verify/accepting-ids-from-wallet-online) [Reference Implementation (GitHub)](https://github.com/google-wallet/identity-reference-implementation/tree/main/verifiers-reference-implementation) 4

#### Test your integration end to end

Present your Utopia test ID pass against your service, verify every item in the end-to-end checklist (including `issuerAuth` validation against the Utopia Sandbox cert), and record a demonstration video.
[Step 4: Test your integration](https://developers.google.com/wallet/identity/verify/test-your-integration) [Try verifier.multipaz.org](https://verifier.multipaz.org) 5

#### Go live as a Relying Party

Submit the **Relying Party Onboarding Form** with your production CSR, branding assets, and sandbox E2E video (formally accepting the [Relying Party ToS](https://developers.google.com/wallet/identity/verify/relying-party-tos)). Once approved (typically 3--5 business days), Google returns your signed production certificate and unique `gw_rp_metadata_bytes`.
[Step 5: Go live as a Relying Party](https://developers.google.com/wallet/identity/verify/relying-party-onboarding) [Open RP Onboarding Form](https://support.google.com/pay/merchants/contact/wallet_identity_relying_partners)

### Verifier Registrars (Aggregators)

1

#### Submit Root CAs \& set up the sandbox

First, submit the **Verifier Registrar Onboarding Intake Form** with your **Sandbox and Production Root CA Certificates** (accepting the [Verifier Registrar ToS](https://developers.google.com/wallet/identity/verify/verifier-registrar-tos)) so Google can trust your Sandbox Root CA. In parallel, allowlist your test Google Account and switch a test Android device to sandbox mode.
[Open VR Intake Form](https://support.google.com/pay/merchants/contact/wallet_verifier_registrar_intake) [Step 1: Set up the sandbox](https://developers.google.com/wallet/identity/verify/sandbox) 2

#### Create a test ID in the sandbox

Use a second Android device running the Utopia ePassport Simulator to provision a simulated **ID pass** into Google Wallet on your sandbox device.
[Step 2: Create a test ID](https://developers.google.com/wallet/identity/verify/create-test-id) 3

#### Integrate as a Verifier Registrar

Follow the five implementation steps in the Verifier Registrar integration guide:

- **Step 3.A --- Configure CA \& CBOR metadata:** Set up your X.509 certificate profile (OID `1.3.6.1.4.1.11129.10.1`) and CBOR metadata schema.
- **Step 3.B --- Format \& sign the request:** Build the OpenID4VP JSON query and sign the JWS with your End-RP leaf certificate.
- **Step 3.C --- Trigger the API:** Call Android `CredentialManager` or Web `navigator.credentials.get()`.
- **Step 3.D --- Decrypt \& validate the response:** Decrypt the JWE and verify the IACA certificate chain and MSO on your server.
- **Step 3.E (Optional) --- Add Zero-Knowledge Proofs:** Verify age predicates without receiving the user's birthdate.

[Step 3: Integrate as a Verifier Registrar](https://developers.google.com/wallet/identity/verify/verifier-registrar) [VR CA \& Metadata Specs](https://developers.google.com/wallet/identity/verify/verifier-registrar#technical_specifications) 4

#### Test your integration end to end

Once Google notifies you that your Sandbox Root CA is trusted, sign a test End-RP certificate, trust the Utopia Sandbox cert on your server, test with your Utopia test ID pass, and record demonstration videos for both verifier-hosted and merchant-hosted flows.
[Step 4: Test your integration](https://developers.google.com/wallet/identity/verify/test-your-integration) [Get Utopia Sandbox Cert](https://developers.google.com/wallet/identity/verify/sandbox#sandbox-iaca-root) 5

#### Go live as a Verifier Registrar \& onboard End RPs

Submit your E2E videos for review. Google approves your videos and trusts your Production Root CA in parallel. Then, register each downstream client using the **Verifier Registrar Client Onboarding Form** and issue leaf certificates with a globally unique Distinguished Name.
[Step 5: Go live as a Verifier Registrar](https://developers.google.com/wallet/identity/verify/verifier-registrar-onboarding) [Open VR Client Form](https://support.google.com/pay/merchants/contact/wallet_identity_verifier_registrar_client_intake)

## What you'll need before you start

- A **server** that creates requests and validates responses. Generate the full request on your server, even for Android apps.
- **Two Android devices** for testing: one runs the ePassport simulator, and the other holds the test ID in Google Wallet. Use dedicated test devices, because switching to sandbox deletes the device's production Wallet data.
- A **@gmail.com Google Account** to use in Google Wallet while you test.
- Your **display assets** for the consent screen: display name, logo (see the [Brand Guidelines](https://developers.google.com/wallet/identity/verify/brand-guidelines)), privacy policy URL, and Terms of Service URL.