Step 4: Test Your Integration

Before going live in production, verify that your integration works end to end in the sandbox using your test ID pass, then record a demonstration video of the complete flow. Google reviews this video during onboarding in Step 5.

Start

Choose your path RP, Verifier Registrar, or In-Person

1
Set up the sandbox Allowlist account & switch device
2
Create a test ID Add a test ID pass to Wallet
3
Integrate Build by your path:
Relying Party→ Verifier Registrar→
4Here
Test integration Run E2E checklist & record video
5
Go live Launch by your path:
Relying Party→ Verifier Registrar→

Steps on this page

A Check sandbox setupDevice, test ID, signing keys & IACA root B Test request & UX flowVerify selector, consent screen & errors C Test server validationVerify JWE decryption & IACA signatures D Record E2E videoRecord demo for RP or VR approval

Essential testing references

Supported Credentials & Attributes

Check the exact doctype_value identifiers and claim paths supported across mDLs, ID passes, and Photo IDs.

Supported Issuers & IACA Certificates

Download production issuer IACA root certificates and the Utopia Sandbox cert.

Interactive Web Verifier Tool

Compare your integration side-by-side against the OpenWallet Foundation's hosted reference verifier.

Step A: Verify your sandbox test setup

Confirm these four prerequisites are in place before running your end-to-end test:

  1. Device in sandbox mode with a test ID: Your Android test device is switched to SANDBOX (Step 1) and has a Utopia ID pass added in Google Wallet (Step 2).
  2. Sandbox request signing:
    • Relying Parties: Your server signs requests with the pre-trusted Sandbox Test Key Pair and Metadata.
    • Verifier Registrars: Google has confirmed your Sandbox Root CA is in the sandbox trust store, and your server signs requests with a leaf certificate chained to your Sandbox Root CA and includes your CBOR-encoded gw_rp_metadata_bytes (Step 3.A: VR Specs).
  3. Request includes an ID pass doctype: Because the sandbox test ID is an ID pass, your dcql_query requests com.google.wallet.idcard.1 or org.iso.23220.photoid.1 (or uses the multi-credential request from Step 3.A).
  4. Server trusts the Utopia Sandbox cert: Your server's trust store includes the Utopia Sandbox cert so issuerAuth signature verification succeeds for the Utopia test ID.

Step B: Test the request, user experience & error handling

Run through each of the following checks on every platform you support (Android app, mobile web, and desktop cross-device web):

  • Visible entry point: A clear button (such as "Verify with Digital ID") initiates the request upon user tap/click.
  • Android app (if applicable): CredentialManager.getCredential() opens the Android credential selector and displays your sandbox test ID pass.
  • Web (if applicable): navigator.credentials.get() opens the credential selector on mobile browsers—and displays the cross-device QR code on desktop browsers when using Signed Requests.
  • Google Wallet consent screen: Tapping the credential opens Google Wallet and displays the expected display name, logo, and privacy policy link from your gw_rp_metadata_bytes, along with only the attributes you requested.
  • Data minimization: Only the attributes required for your use case are requested (see Supported Credentials & Attributes), and intent_to_retain is set accurately for each claim.
  • User cancellation & fallback: Canceling the sheet (GetCredentialCancellationException on Android or a rejected promise on Web) or testing without a matching ID (NoCredentialException) is handled gracefully in your UI.

Step C: Test server-side decryption & cryptographic validation

After approving the consent screen in Google Wallet, verify your server performs all required cryptographic checks:

  • JWE decryption: Your server decrypts the returned identityToken using the private key corresponding to the client_metadata.jwks encryption public key and extracts the vp_token.
  • SessionTranscript reconstruction: Your server reconstructs the SessionTranscript using OpenID4VPDCAPIHandover with the exact request nonce, encryption JWK thumbprint, and platform origin (android:apk-key-hash:... or web origin URL).
  • IACA certificate chain validation (issuerAuth): Your server extracts the issuer certificate chain from issuerAuth and validates it against the Utopia Sandbox cert in sandbox—and against the official production root certificates in Supported Issuers & IACA Certificates for production. Never skip this check.
  • MSO, ValueDigests & deviceSignature verification: Your server verifies the Mobile Security Object (MSO) signature, confirms the ValueDigests match the returned data elements, and validates deviceSignature (ISO/IEC 18013-5 sections 9.1.2 and 9.1.3).
  • Zero-Knowledge Proofs (if implemented): If requesting mso_mdoc_zk, your server validates the returned proof using longfellow-zk.

Step D: Record your end-to-end demonstration video

Once your integration passes Steps B and C, record a screen capture video demonstrating the complete user journey from your app or website through Google Wallet consent and back to your verified state. The following table shows what to include based on your onboarding path:

Video requirement Relying Parties (Direct) Verifier Registrars (Aggregators)
Screens to show Full user journey: entry screen → credential selector → Google Wallet consent & authentication → verified result in your app or site Full user journey for your initial (1st) downstream Relying Party
Flows to record Your Android app and/or web integration flow Both verifier-hosted (self-hosted) and merchant-hosted (RP-hosted) flows, as applicable
Branding & display assets Your actual display name, logo, and privacy policy / Terms of Service URLs Actual merchant display assets (name, logo, Terms of Service URL) and your aggregator display assets

Next step

Choose your onboarding path to submit your video and launch in production:

Step 5 (Relying Party): Go Live → Step 5 (Verifier Registrar): Go Live →