Uber Integrates Apple's Verify with Wallet API

Uber is integrating Apple's Verify with Wallet API into its Identity Verification Platform, aiming to streamline user onboarding and compliance for market expansion. This move enhances security and accountability across its diverse services.

The company is expanding its verification methods beyond in-house document scanning and selfie capture by partnering with technology leaders. Mobile wallets, like Apple Wallet, now support mobile documents (mDocs) such as driver's licenses and photo IDs, enabling seamless presentation for verification.

Uber was an early adopter of Apple's Verify with Wallet API, a solution introduced at WWDC 2022. It's now integrated into multiple use cases within Uber's cross-app Identity Verification Platform.

Privacy-Focused Verification

Unlike traditional methods reliant on document scanning or user input, Verify with Wallet merges convenience, platform security, and user experience with a privacy-first approach. It allows Uber to verify digital ID data with government-backed provenance.

This integration significantly reduces user friction and operational errors, leading to higher conversion rates and more verified users. The API promotes privacy by offering transparency on requested identity information and its duration of use.

Apps can only request specific data necessary for a transaction, preventing oversharing. Crucially, neither the issuing authority nor Apple can track when or where a user shares their digital ID.

These capabilities enable users to verify their Uber accounts in seconds, without needing a physical ID. This efficiency benefits use cases across Uber, Uber Eats, and Postmates.

Addressing Complex Verification Needs

Uber operates across multiple apps and market segments, each with distinct identity verification requirements. A driver onboarding flow differs significantly from an age-gated ordering process or a car rental scenario.

Verify with Wallet supports this breadth through an app-level Entitlement configuration. However, each data element requires individual approval from Apple for its intended use case.

The platform must be flexible enough to handle various approved data combinations while strictly enforcing scope limitations for each use case. This requires robust orchestration of data elements and adherence to strict architectural requirements.

Architectural Challenges and Solutions

Key architectural requirements included building a platform-agnostic mapping layer, managing high-assurance cryptographic validations per ISO/IEC 18013-5, and establishing reliable trust anchor updates for government issuing authorities.

Integrating Verify with Wallet into a scalable, compliant platform, rather than through numerous one-off integrations, presented the core engineering challenge.

Uber's backend service centrally manages the request flow via server-side configurations. These define specific data elements and the associated IntentToStore parameter, indicating whether data is for one-time verification or long-term persistence.

Decryption, Validation, and Trust Anchors

Uber's Identity Verification service decrypts the Apple Wallet payload and performs validation checks against ISO/IEC 18013-5 and Apple's developer documentation. Security in transit is managed via HPKE (Hybrid Public Key Encryption).

The response is encrypted using the app's Identity Access Certificate. Uber's backend then decrypts the CBOR-encoded payload. A session transcript binds the response to a specific transaction, preventing replay attacks.

Validation involves three key steps: MSO verification to ensure data integrity and validity, device binding to confirm the request originates from the authorized device, and issuer certificate verification against a trusted IACA root certificate.

Maintaining this chain of trust at scale necessitates a proactive strategy for managing the rotation of IACA root certificates. Uber maintains a registry of certificates from all supported issuing authorities, sourced officially and from services like the AAMVA Digital Trust Service.

The system supports multiple active certificates per jurisdiction to ensure continuity during key rotations or new certificate issuances, preventing disruptions when governments update their infrastructure. This commitment to keeping the registry current is vital for secure and uninterrupted verification as standards evolve.

Uber's integration with the Verify with Wallet API is a significant step, supporting government-issued digital IDs for a smoother, more secure verification process. This privacy-preserving design minimizes data requests and prevents oversharing.

The solution employs data encryption, session transcripts, and validation against ISO/IEC 18013-5, reflecting a dedication to user protection and privacy in an evolving global digital identity landscape. This approach contributes to more robust digital identity verification, a critical area as concerns about online authenticity grow, highlighted by the challenge of distinguishing humans from bots, as discussed in Bots Outnumber Humans Online: The Proof of Human Imperative. Ensuring secure digital identity verification is paramount in mitigating risks like those associated with the dark web.