Apple mDoc Support: iOS 26 enables ID Verification

At WWDC25, Apple announced official support for mobile documents (mdocs) through the Digital Credentials API, enabling websites to request and verify a user's digital ID in iOS 26 directly from Safari. This brings Apple's digital credentials, compliant with the ISO 18013-5 standard, to the web for secure, user-consented identity verification.

This update represents a major catalyst for the digital identity ecosystem. For years, online identity proofing has been plagued by friction, privacy risks, and fraud. By integrating standardized Apple digital credentials, the new framework streamlines verification for use cases like age checks, enterprise logins, and customer onboarding.

This article breaks down what Apple's mdoc support means for developers and businesses, how it works at a high level, and how to prepare for its arrival in iOS 26.

At the heart of this new identity paradigm is the mdoc (mobile document), a standardized format for digital identity credentials stored in Apple Wallet, such as a mobile Driver's License (mDL) or a corporate ID.

A key feature of the mdoc standard is selective disclosure, which allows users to share only the specific data fields required for a transaction (e.g., just "over 21") instead of their entire ID. This privacy-preserving capability is defined by the ISO 18013-5 and ISO 18013-7 standards, which govern how mdocs are structured, secured, and presented online.

The W3C Digital Credentials API serves as the bridge between websites and the user's Apple Wallet. When a website needs to verify a user's identity, it no longer requires a custom app or redirects. Instead, the process is orchestrated by the browser.

The typical verification flow is as follows:

1. Request Initiation: A website or web app calls the JavaScript API (navigator.credentials.get()) to request a specific credential, such as proof of age from an mDL.
2. System Hand-Off: iOS 26 intercepts this call and invokes the native Apple Wallet interface.
3. User Consent: The user is presented with a secure, OS-level prompt showing exactly which information is being requested (e.g., "This site is requesting your age verification"). The user must authenticate with Face ID or Touch ID to consent.
4. Secure Data Transfer: Upon consent, the wallet releases only the requested data to the browser, which is then passed to the website for verification.

This entire flow is designed to be secure and seamless, eliminating the need for users to upload physical ID photos or fill out forms.

• Reduced Friction & Higher Conversion: Drastically simplifies onboarding and verification processes.
• Enhanced Security & Fraud Reduction: Relies on cryptographically signed credentials from trusted issuers (e.g., DMVs), minimizing the risk of fake IDs.
• Simplified Compliance: Requesting only necessary attributes helps meet data minimization requirements under regulations like GDPR and CCPA.
• Interoperability: Built on global standards (W3C, ISO), ensuring compatibility across platforms that adopt them.

• Full Control & Privacy: Users explicitly consent to every data share.
• Convenience: Eliminates the need to carry physical cards or manually enter identity information.
• Enhanced Security: Reduces the risk of data over-sharing and phishing attacks.

While the deep technical implementation is covered in our guide to the Digital Credentials API, developers and product managers should start preparing now.

Here are the key strategic steps:

1. Identify Use Cases: Pinpoint processes in your user journey that currently rely on manual identity verification (e.g., account creation, age-gated content, high-value transactions) and would benefit from instant, high-assurance digital ID checks.
2. Review Data Needs: Audit the identity attributes you currently collect. With Apple's mdoc support, plan to transition to requesting only the minimal data required for each transaction.
3. Educate Your Team: Familiarize your development and compliance teams with the relevant standards, including ISO 18013-5 for mdocs and the W3C Digital Credentials framework.
4. Plan for Backend Verification: The credential returned by the API must be cryptographically verified on your backend to ensure its authenticity and integrity. Plan for the server-side logic required to process these credentials.

Apple's decision to integrate mDocs directly into the web via its native wallet has significant strategic implications for the broader digital identity landscape.

By prioritizing mdoc (ISO 18013-5), Apple establishes it as the primary standard for verifiable government-issued IDs (like driver's licenses) on the web. This gives the mdoc format enormous momentum for official identity use cases.

However, this doesn't diminish the role of other formats like W3C Verifiable Credentials (VCs), often based on SD-JWT or JWT-VC. These formats are critical for non-governmental credentials such as university diplomas, employee badges, or event tickets. The Digital Credentials API itself is designed to be extensible, meaning it could support these other formats in the future. The immediate result is a dual ecosystem: mdoc for official IDs, and other VC formats for the rest, all potentially accessible through the same underlying web standard.

The native integration gives Apple Wallet a distinct advantage, making it the default and most seamless option for users on iOS. This presents a challenge for third-party wallet apps.

While the API could theoretically allow users to choose a different default wallet, the native OS experience is hard to compete with. Third-party providers will likely need to rely on alternative protocols like OpenID4VP initiated via universal links, which may result in a less integrated user experience (e.g., requiring app switching). This move solidifies Apple Wallet's central role, compelling other providers to differentiate through specialized features, enterprise solutions, or by focusing on credential types not yet prioritized by Apple.

Apple's mdoc support in iOS 26 is more than an API. It's a shift toward a more secure, private and user-centric internet. By embracing open standards, Apple has paved the way for a future where verifiable digital credentials replace outdated and insecure methods of identity verification.

For businesses, this is an opportunity to build next-generation user experiences based on trust and transparency. Start exploring how Apple digital credentials can transform your services today.