Aadhaar Verification API: Consent & Compliance
Aadhaar is the most powerful identity signal in India — and the most sensitive. Here is how to use it correctly in a KYC flow.
Aadhaar is India's most widely held identity number, which makes it extremely useful for KYC — and extremely sensitive. Using it correctly means being consent-first and aligned with the Digital Personal Data Protection (DPDP) Act. This guide covers how Aadhaar verification works through an API and how to handle the data responsibly.
Consent comes first
Aadhaar must only be checked with the holder's explicit consent, captured and recorded for your audit trail. A well-designed Aadhaar API expects a consent flag on every request and will not return raw Aadhaar numbers in responses.
What you get back
- A validity/active status for the Aadhaar.
- Available identity signals such as age band, gender and state.
- A tokenised reference instead of the raw Aadhaar number.
POST https://api.bilapi.com/v1/aadhaar-verification
X-Bilapi-Api-Key: <your_api_key>
Content-Type: application/json
{
"aadhaar_number": "XXXXXXXX1234",
"consent": "Y"
}Handling the data responsibly
- Capture and store consent before every Aadhaar check.
- Never log or display the full Aadhaar number — work with the tokenised reference.
- Encrypt in transit (TLS 1.3) and restrict access to the data at rest.
- Keep a request log for every verification for audit purposes.
Aadhaar in a wider KYC flow
Aadhaar rarely stands alone. Many teams pair it with PAN checks (and confirm the PAN–Aadhaar linkage via the Aadhaar to PAN API), or use mobile-based prefill to reduce the fields a customer types. The goal is a fast, consent-first flow that still produces a strong, auditable identity record.