How we’re building this · consumer UX direction
Getting a trusted document in, and sharing the minimum to prove something. A phone may decide which wallet answers — it does not take over the wallet’s job.
Protocol terms never reach the person. But every simplified line is bound to the verified protocol data beneath it: simplification must never weaken verifier identity, consent integrity, or minimisation.
| What the person sees | What it is bound to (never weakened) |
|---|---|
| “✓ Verified issuer — Bundesdruckerei” | Authenticated certificate path to a trusted issuer; the name comes from the certificate, never from caller-supplied text. |
| “weindeals.example · registered verifier” | Verifier authenticated and its identifier bound to its certificate; the shown name is the authenticated one, and its stated purpose comes from its registration. |
| “Over 18: Yes” — and nothing else | A single selectively-disclosed claim from a credential whose issuer signature and device key-binding verified; only that claim is placed in the response. |
| “Not shared: name, date of birth, address” | Data minimisation: attributes outside the request are never assembled into the response — the “not shared” line is the true response contents. |
| “This site is asking for more than it registered for” | The request is checked against the verifier’s registration; an over-ask is flagged before anything is shared. |
| “Approve with Face ID” | A device-key signature over the exact request nonce (proof of possession). No approval → no response leaves the device. |
Pick a journey and tap the buttons — the same real controls a person would use, operable by keyboard and VoiceOver. Nothing is sent anywhere. Use Back or Start over any time; the “Aa Large text” button at the top scales this too.
A clickable concept for review and moderated testing — no data is sent.
Issuer-first, ordinary verbs, no protocol words. As few screens as it takes; a confident user moves quickly, an unsure one is never stuck. Every screen’s controls are real and reach VoiceOver in reading order.
← scroll to see every screen →
Use your phone to prove who you are — online and in person.
Meet the offer, issuer first
The authority is named and verified up front; purpose in one line; the attribute list is an optional button, never an approval wall.
The 6-digit PIN you chose for your ID card. You’ll enter it when you tap the card.
“I’m not sure” shows how to check or reset it — no rush.
Ask about the PIN before the tap — calmly
We never assume a known PIN. “I’m not sure” leads to help framed as normal, not failure. Transport-PIN, CAN and blocked-PIN detail live in that help, not here.
Reading… keep the card still
The tap — guided, and always cancellable
Live spoken status (“Reading… keep still”, and “Connection lost, reposition” on a slip). Every NFC and network step can be cancelled and resumed; a slip reconnects — it never restarts the journey.
This lets you prove your identity and age, and sign in to public services.
Confirm by purpose & issuer — not a checklist
We explain what the document is for and who stands behind it; the detailed attributes stay behind “What will be added?”, so the primary screen is calm.
We’ll send you a notification the moment it’s ready. You can close the app.
Preparing is a state, not a spinner
Issuers deliver asynchronously; we say so, let the user leave, and continue on the home card with a notification when ready. No time promises until measured with the real Ausweis SDK, network and issuer paths.
End on something useful to do
Success leads into a real, privacy-preserving action — prove age without revealing name or birth date — turning a one-time add into an active wallet.
Issuance status is a persistent card the user can leave and return to, carrying its own action so recovery is one tap away. It survives closing the app and rebooting.
Preparing
Calm, no action needed.
Ready
Usable; its primary action is to prove/share.
Needs attention
Recoverable, progress saved, one-tap continue — never a dead end.
When a website or reader asks, the wallet authenticates the verifier, validates the request, shows a plain request, shares the minimum, and takes an explicit approval. This screen is ours to get right.
Not shared: your name, date of birth, or address. Not stored by the site.
Who · what · why · retention · and what is not shared
One legible request: verifier + registered purpose, the single answer shared, retention stated, and an explicit “Not shared” line. Approval is a deliberate Face ID action.
You can share nothing, or only what makes sense.
Warn on over-asking — a safety moment
Because the wallet authenticates the verifier against its registration, it flags a request beyond the declared purpose. The default is “don’t share”. Protection a passive chooser cannot offer.
Each names what happened in plain words and offers one clear recovery. Nothing dead-ends; progress is always saved.
You have 2 tries left. Take your time.
Wrong PIN
Tries remaining shown; help offered before the last try.
For safety it locks after three wrong tries. You can reset it and pick up where you left off.
Blocked PIN
CAN / reset detail lives here in context, not on the calm primary screens. Resume after reset.
Line up the top of your phone with the card and hold still.
NFC interrupted
Auto-resume the read; never restart the whole flow. Cancel always present.
It doesn’t have the chip reader (NFC) needed. You can still add your ID another way.
Unsupported device
Detected before the tap; routed to alternatives, not a blank failure.
Bundesdruckerei couldn’t confirm your details. Reason: the card has expired.
Issuer rejection
The exact human reason from the issuer, plus retry and a real contact path.
Your progress is saved. You can pick up right where you left off.
Timeout
Saved progress + resume; same pattern for any network step.
This is taking longer than usual at the issuer. You don’t need to wait here.
Pending too long
Honest about issuer delay; converts waiting into a notification + status on the home card.
You were adding your National ID. Want to finish?
Returning & interrupted session
A resumed session is greeted, not reset; continue or start over.
Use the “Aa Large text” button at the top to scale every screen. Full method and
results: docs/ux/accessibility-validation.md. Empirical testing with people
aged ~65–85 is the remaining gate before this is called final.