Configure Site-Global Didit Identity Verification

A Joomla Super User can configure one site-wide Didit profile for new QCDS Level 2 Requests. When Global Identity Verification is enabled, it overrides sender-owned account-level profiles for new Level 2 participants across the site.

Open the Global Identity Verification Settings

  1. In Joomla Administrator, open QC Digital Signature.
  2. Select the Identity Verification tab.
  3. Choose Didit as the Provider.

Only a Joomla Super User can change the Global provider profile.

Enter the Didit Values

The Global Didit form uses four Didit-related values:

  • Didit API Key: the provider credential used by QCDS. It is encrypted locally when saved.
  • Didit Workflow ID: the published KYC workflow QCDS must use. The saved value must match QCDS's accepted Workflow ID format.
  • Didit Webhook Signing Secret: the secret QCDS uses to validate Didit webhook callbacks.
  • QCDS Didit Webhook URL: a read-only public HTTPS URL generated by QCDS. Copy this URL into the corresponding webhook destination in Didit.

Blank credential fields preserve existing saved values. Enabling the profile requires at least a saved API Key and Workflow ID.

Enable, Save, and Test

  1. Select Enable Global Site Identity Verification for new requests when you are ready for the Global profile to control new Level 2 transactions.
  2. Click Save Global Identity Settings.
  3. When provider credentials are present, QCDS immediately runs the connection test after the save.

The Didit test verifies that the API key can read the configured workflow, that the Workflow ID exists, and that the workflow is published/active and KYC-capable. QCDS then probes the exact session-creation capability used by signers.

Understand Sandbox and Live Test Results

For a Didit sandbox/test application, QCDS creates a sandbox-only test session, confirms that a session ID and hosted URL are returned, and immediately attempts to delete that preflight session.

For a live Didit application, QCDS does not launch an unflagged live verification just to test the connection. A live application normally rejects the sandbox-only probe; QCDS treats that provider response as confirmation that the API/workflow connection is valid without creating a potentially billable live identity session.

Before Sending Level 2 Requests

Confirm the Global card reports a connected/ready provider and a recent Last tested value. If Global is enabled but not ready, new Level 2 Requests are blocked rather than falling back to a sender's account-level provider.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDS feature? Visit the QC Digital Signature Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.