Production setup

Production is where real customers receive documents and share their information. EU rules require the national Registrar and certificate authorities to confirm your organization first. This guide explains every step of the plan that gets you there.

Where to find the plan

Owners and admins open Production setup in the Production environment, or select Open Production setup on Home. Each step links to its section here.

The plan groups steps by what they need:

Group	What is in it
Needs you	Steps you can do now
Waiting on others	Steps waiting for the Registrar, a certificate authority or LutraID
Later	Steps that can't start until an earlier one is done
Done	Finished steps

Each step shows Who acts: you, the Registrar, a certificate authority or LutraID. LutraID never estimates how long the Registrar or a certificate authority takes.

This guide follows the hosted service, where checks run in Intermediary mode: LutraID is your intermediary, uses its own access certificate and forwards each result to your system without keeping it. On a self-hosted installation (Direct mode) there is no result endpoint step, and each verifier requests its own Production access certificate on its Registration tab. For documents, the certificates you need depend on how you run LutraID and which documents you issue; the issuing steps below say what applies to you. Production starts empty: Sandbox settings are not copied.

If a step or this guide doesn't answer your question, use Ask support on the step. It fills in the plan, the step and its status for you.

Legal identity

Your organization's official name, country, register identifier (for example a VAT number, LEI or EUID), registered address, website and contact. Wallets show it behind every document and request, and it goes into your Production certificates and your Registrar application.

• Who acts: you. Only owners can change the legal identity; admins can read it.
• What you need: your entry in the business register.
• Steps: open Settings → Legal identity, enter the details exactly as they appear in the business register, and save.
• What comes back: the step turns Done, and the Registrar step becomes possible.
• Common problems:
  • Needs correction after a change: the identity no longer matches what your registration captured. Review it, then ask support whether the Registrar needs to confirm the change.
  • Saving a change to the name, identifier or country clears the Registrar's decision LutraID recorded. Production certificate requests stop until a decision is recorded again.

The Registrar's decision

The national Registrar confirms who your organization is and what it issues and asks for. LutraID records the decision. Production certificate requests carry your verified legal name, so they unlock only after that.

• Who acts: you apply, the Registrar decides, LutraID records the decision.
• What you need: your legal identity, the purpose of each check, and the name of your legal representative. The Registrar's own process decides what else to bring.
• Steps:
  1. Apply to the Registrar using their process.
  2. Select Mark as sent on the step (owners only). The step moves to Waiting on others with the date. Mark as not sent undoes it.
  3. When the decision arrives, select Send us the decision. Support opens with the plan and the step filled in.
  4. Enter the Registrar's reference for the decision (up to 500 characters) and send it.
• What comes back: LutraID records the decision and the step turns Done. Certificate requests unlock.
• Common problems:
  • Waiting for the Registrar for a long time: LutraID gets no updates from the Registrar. Contact them directly.
  • The step asks you to apply again after you marked it as sent: a change to the official name, identifier or country clears the mark and any recorded decision.
  • LEGAL_VERIFICATION_PENDING or REPRESENTATIVE_AUTHORITY_MISSING, or LEGAL_IDENTITY_UNVERIFIED when you request a certificate: LutraID hasn't recorded the decision or your representative's authority yet. Send the decision through support.
  • LutraID withdrew a recorded decision, for example after the Registrar corrected it. New checks, offers and certificate requests stop until a decision is recorded again. Requests already started finish, and documents and certificates already issued stay valid.

Set up issuing

An issuer and the documents it issues, in Production.

• Who acts: you.
• What you need: the documents you tested in Sandbox.
• Steps: open Setup → Issuers in Production, create an issuer, and add its documents on the issuer's Documents tab. See Set up an issuer.
• What comes back: the step turns Done once every issuer has at least one document.
• Common problems: PROFILE_NOT_SUPPORTED or Needs correction: a document is not supported in Production yet. Choose a supported one or ask support.

Access certificate for issuing

A certificate from the access certificate authority that lets wallets confirm they are talking to you when they collect a document.

• Who acts: you, then the access certificate authority.
• What you need: the Registrar's decision recorded by LutraID.
• Steps:
  1. Open the issuer's Certificates tab.
  2. Create and download the request.
  3. Send it to the access certificate authority.
  4. Upload the certificate chain it returns.
• What comes back: while the authority works, the step shows Waiting for the certificate authority. After the upload it turns Done.
• Common problems: ACCESS_CERTIFICATE_EXPIRED, ACCESS_CERTIFICATE_REVOKED, ACCESS_CERTIFICATE_UNTRUSTED, TRUST_SOURCE_UNAVAILABLE or SANDBOX_ANCHOR_IN_PRODUCTION: the certificate can't be used in Production. Request a new one; ask support if the code stays.

Signing certificate

A certificate from a document certificate authority that proves documents really come from you. Each document format needs its own.

• Who acts: you (often your PKI or security team), then your certificate authority.
• What you need: the Registrar's decision recorded by LutraID, and the values your certificate authority requires (certificate policy, where to download its certificate, where to check revocation).
• Steps:
  1. Open the issuer's Certificates tab.
  2. Enter the values your certificate authority requires and create the request.
  3. Send the request to your certificate authority.
  4. Upload the certificate chain it returns.
• What comes back: the step waits for the certificate authority until you upload the chain, then turns Done.
• Common problems: SIGNING_CERTIFICATE_PROFILE_MISMATCH or CERTIFICATE_STATUS_UNAVAILABLE: the certificate doesn't fit the document, or its status can't be checked. A rejected upload names the reason on the Certificates tab.

Registration for documents

A registration certificate from the Registrar that says you may issue these documents.

• Who acts: you, with the Registrar.
• What you need: a valid access certificate for the issuer, and the registration certificate the Registrar gave you.
• Steps: on the issuer's Certificates tab, upload the registration certificate and select the documents it covers.
• What comes back: the step turns Done.
• Common problems: REGISTRATION_CERTIFICATE_MISSING, REGISTRATION_CERTIFICATE_INVALID or RC_SCOPE_NOT_COVERED: no certificate covers a document, or it wasn't issued by the Registrar for Production. Ask the Registrar for a certificate that covers every document.

Set up checks

A verifier and the checks it runs, in Production.

• Who acts: you.
• What you need: the checks you tested in Sandbox.
• Steps: open Setup → Verifiers in Production, create a verifier, and add each check on its Checks tab. See Set up a verifier.
• What comes back: the step turns Done once every verifier has at least one check.
• Common problems: PROFILE_NOT_SUPPORTED: the check is not supported in Production yet.

Purpose and privacy

Why you ask for the information, your privacy policy and your data protection supervisory authority, for each check. Wallets show it before customers share anything, and it is part of your Registrar application.

• Who acts: you, usually with your compliance or data protection officer.
• What you need: your privacy policy URL and the name of your supervisory authority.
• Steps:
  1. Open the verifier's Registration tab.
  2. Write one sentence per check on why you need the information.
  3. Add the privacy policy and supervisory authority, then save the registration.
• What comes back: the step turns Done.
• Common problems: ENROLLMENT_NOT_ACTIVE: the registration hasn't been saved yet.

A check's Purpose from the template is read-only; ask support to correct it. Registered purpose (sent to the Registrar) on the Registration tab is the purpose used for registration, and it can differ from the template purpose.

Checks accept only trusted issuers

Each check in Production should accept documents only from issuers on trusted lists.

• Who acts: you. LutraID provides the trusted lists.
• Steps: on the step, select Choose trusted lists for a check. Choose Only issuers on trusted lists, pick at least one list for every document, then select Save issuer trust.
• What comes back: the check shows Done with the list names. The plan shows each check once, with every verifier that uses it, and a change applies to all of them.
• Common problems:
  • Waiting for trusted lists: no trusted list is available for Production yet. Use Ask support.
  • Could not check: reading the lists failed. Select Retry.

Result endpoint

The HTTPS address where LutraID forwards each check result. As your intermediary, LutraID keeps nothing.

• Who acts: you, usually a developer.
• What you need: an HTTPS endpoint that accepts POST requests with a JSON body.
• Steps:
  1. Open the verifier's Result delivery tab (Intermediary mode only, owners and admins).
  2. Enter the endpoint and save. Copy the signing secret into your secrets manager; it is shown once.
  3. Select Send test result and check that your system accepts it.
• Checking the signature: each request carries an X-LutraID-Signature header of the form t=<unix seconds>,v1=<hex>. Compute HMAC-SHA256 with your signing secret over <t>.<raw request body> and compare it with v1 in constant time. Reject old timestamps, and deduplicate on the Idempotency-Key header. Payload and code: Receive check results.
• Today: result endpoints can be set in Sandbox only. In Production this step waits until Production activation is available; build and test your system against Sandbox meanwhile.
• Rotating the secret: use the menu next to Signing secret. The old secret stops working at once.
• What comes back: the step turns Done once every verifier has an endpoint and a secret.
• Common problems: results are refused: check the URL and path, and that the endpoint accepts POST with JSON. The Result delivery tab lists the last 20 deliveries. LutraID tries up to three times; if delivery still fails, the check is marked Result could not be sent to your system and can't be sent again, because no values are kept.

Registration for checks

One registration certificate from the Registrar per check. It names LutraID as your intermediary and says you may ask for this information. Registering checks for Production in Intermediary mode isn't available on LutraID yet; you can prepare each check's purpose and privacy details now.

• Who acts: you, with the Registrar.
• What you need: the Registrar's decision recorded by LutraID, the purpose of each check, and the certificates the Registrar gave you.
• Steps: on the verifier's Registration tab, upload one registration certificate per check.
• What comes back: the step turns Done when every check has a certificate that still covers what it asks for.
• Common problems: Needs correction after you change a check's purpose or the information it asks for: the certificate no longer covers it. Ask the Registrar for a new one. Codes: REGISTRATION_CERTIFICATE_INVALID, RC_SCOPE_NOT_COVERED.

Production activation

LutraID's own Production registration as your intermediary. LutraID must be registered before it can act for you in Production.

• Who acts: LutraID. Nothing is needed from you.
• What comes back: the step turns Done when activation is available, and testing opens for your checks.
• Common problems: Waiting for LutraID · Not available on LutraID yet is expected until LutraID completes its registration. Codes: INTERMEDIARY_PIPELINE_UNAVAILABLE, INTERMEDIARY_RELATIONSHIP_MISSING, INTERMEDIARY_ASSOCIATION_UNVERIFIED, WALLET_ATTESTATION_TRUST_UNCONFIGURED.

Production API key

An API key for your systems in Production. Sandbox keys don't work there.

• Who acts: you, usually a developer.
• Steps: open Developers → API keys in Production, create a key, and store it in your secrets manager. See API keys.
• What comes back: the step turns Done. Calls are refused with a clear reason until Production is live.
• Common problems: a revoked key doesn't count; create a new one.

Real tests

Issue each document to yourself and run each check once with a real wallet, before customers use them.

• Who acts: you.
• What you need: every other step done, and your own wallet.
• Steps: issue each document to your own wallet, run each check on yourself, and find each result in Records.
• What comes back: the step turns Done with the date of the first successful issuance or check in Production.
• Common problems: an issuance or check fails with a Production error. The error names the step to fix.

Something else is missing

LutraID reported a requirement this plan and guide don't explain yet.

• Who acts: you and LutraID support.
• Steps: select Ask support on the step. The plan, the step and the code are filled in.
• What comes back: support explains what is missing, and this guide gets a section for it.

Billing

On SaaS, owners and admins check the subscription under Settings → Billing before relying on Production volume.