Wallet, gateway, verifier: who does what?
The wallet is the part your customer holds. Your business needs a way to request appropriate evidence, check the response and make a service decision. A verifier performs technical checks; a gateway can help connect your application to wallet services.
Five roles in one interaction
A useful way to understand the system is to follow a single request. Imagine a service needs evidence that a customer meets an age threshold. Someone must have issued an acceptable credential, the customer must hold it, and the service must check a presentation of it. The final decision still belongs to the service.
| Role | Job | Example question |
|---|---|---|
| Issuer | Signs a statement about a person or attribute | Why do we trust this issuer for this fact? |
| Wallet | Lets the holder manage and present credentials | Can the person understand and control the request? |
| Verifier | Checks a presentation against technical and trust requirements | Which checks passed, failed or were unavailable? |
| Gateway | Connects your application with one or more wallet integrations | What complexity does the service handle for us? |
| Relying party | Uses the evidence for a service decision | Do we have the evidence and authority to act? |
“Gateway” is a common product description, not a guarantee of a standard set of responsibilities. One supplier might host the whole request and verification journey; another might provide a software component that you operate. Ask for the actual architecture and contract rather than inferring the service from the label.
What happens between request and decision?
Your application starts a request for specified attributes. The customer is shown the requesting service and the information involved. A presentation is returned and checked. Your application then decides whether the evidence meets its policy and how to continue the transaction. Protocol and credential details vary, so have your technical team document the chosen profile.
OpenID4VP is a specification for requesting and presenting credentials. Knowing that a product supports it is useful, but does not establish every supported format, trust arrangement or national integration. Ask about the exact version, profile and configuration rather than accepting “standards based” as a complete answer.
A practical integration also has to handle cancelled requests, expired sessions, unavailable dependencies and repeated callbacks. It should connect the result to the correct transaction and avoid creating duplicate accounts. Your engineering team needs a result model that distinguishes a refusal, a technical failure and an evidence check that did not pass.
How this relates to Ireland's wallet
Ireland's official Government Digital Wallet Web Verifier demonstrates how a holder may share information in different scenarios. It helps make the verifier role tangible. The programme's test environment should remain distinct from any supplier's commercial product and from an organisation's own production deployment.
A supplier may report that it has connected a gateway to the Irish test wallet. Ask which wallet build and credential were used, whether the result is reproducible and which steps are not yet available for production. A screenshot of success cannot answer questions about supported users, recovery, security review or service commitments.
Build, buy or combine?
Building gives your team control over the implementation and creates responsibility for maintaining it. Buying a hosted verifier may reduce initial engineering work, but introduces a dependency on the supplier's availability, roadmap and data handling. A gateway can simplify multiple integrations, provided the abstraction does not hide information your service needs to make safe decisions.
Compare these options against a current use case. A small organisation may reasonably prefer a managed service, while a team with specialised requirements may need more direct control. Neither approach is automatically cheaper. Estimate integration work, support, change management and exit cost alongside the price per verification.
Ask whether you can export decision records, change providers and retain a functioning alternative route. Find out which parts of the implementation are specific to one vendor. An abstraction is useful when it removes repeated work; it is less useful when it makes ordinary failures impossible for your team to understand.
Outsourcing checks does not remove your decisions
Your business still needs to decide what to request, why it needs it, who may access it and what it keeps. Map the personal data seen by the gateway, verifier and your own application. Include diagnostic logs and support screens. A gateway returning a compact result may still process more detailed information behind the scenes.
The European Commission's service-provider guidance describes registration and operational requirements for relying parties. Establish the requirements relevant to your organisation with the responsible advisers. Do not assume the supplier's registration or certificate automatically covers your separate role.
Six questions for a supplier conversation
- What is live? Name production services separately from sandboxes, demonstrations and roadmap items.
- What was tested? Identify the wallet, credential, profile, date and environment.
- What does success mean? Explain each technical check and the decisions still left to us.
- Who sees the data? Show storage, logging, support access and deletion arrangements.
- What happens when it fails? Demonstrate cancellation, timeout, unsupported evidence and recovery.
- What do we own? Set out integration work, customer support, monitoring, change management and exit responsibilities.
Bring the answers into a structured demonstration, then decide whether a bounded pilot would answer the remaining questions. Our readiness guide explains the wider work. No supplier is endorsed by appearing in a discussion or completing a test connection.
In this topic: EUDI Wallet readiness
What should an Irish relying party prepare now?
View all 12 pages in this topic
- EU country tracker
- Country evidence methodology
- Wallet gateways and verifiers
- Irish wallet demo checklist
- Readiness for Irish organisations
- Issuer, wallet and relying-party roles
- Relying-party registration
- PID, EAA and QEAA credentials
- Protocols and formats
- Credential verification flow
- Conformance and certification
- Verifier UX and fallback
Keep up with the Irish evidence
Independent briefings on wallets, identity verification and age assurance.
Join the business briefing