---
title: "Ask for an age or an ID"
description: "Ask a wallet or DigiLocker for only the claim you need, verify the presentation, and let an agent act only after a person approves."
section: "guides"
status: "Planned for 1.6"
spec: "digital-ids"
canonical: "https://mainsdk.dev/docs/guides/ask-for-age-or-id"
updated: "2026-10-28"
---

# Ask for an age or an ID

> Ask a wallet or DigiLocker for only the claim you need, verify the presentation, and let an agent act only after a person approves.

Status: Planned for 1.6 · Canonical: https://mainsdk.dev/docs/guides/ask-for-age-or-id · Updated: 2026-10-28

You will ask for "over 18" without ever holding a date of birth. It takes about 20 minutes.

## You need

- A MainSDK app and a wallet or DigiLocker partner account.

## 1. Declare what you ask for

```yaml title="main.yaml"
digital-ids:
  wallets: [digital-credentials, digilocker]
  requests:
    age:
      purpose: Sell age-restricted items
      claims: [age_over_18]
      need: [age_over_18]
```

A request that asks for a claim beyond `need` fails `mainsdk check` with `MAIN-IDENT-0001`. An empty or unknown wallet list fails with `MAIN-IDENT-0005`.

## 2. Request and verify

Build the request with `ageRequest(18)`, then check the presentation with `verifyPresentation`. It checks the issuer against your trusted list, the nonce, the audience and the key binding, and returns only the claims you asked for. A refused presentation fails with `MAIN-IDENT-0002`; the reason names the check, never a claim value. For DigiLocker, `digilocker({...})` turns the consent into a verified age and drops the date.

## 3. Let an agent act with a person's yes

`AgentApproval` sends a CIBA request to the person, and on approval exchanges it for a token that lives at most 5 minutes and covers one action on one resource. A denied, expired or reused request fails with `MAIN-IDENT-0003`.

## Check that it works

- A wallet that discloses an extra claim is refused or the claim is dropped.
- Try to use an agent token for another action: it fails.
- The DigiLocker request shapes follow its public OAuth API; run one consent flow against the partner sandbox first.