Direct vs Intermediary mode

In Direct mode your organization is the party that talks to the wallet, under its own access certificate. In Intermediary mode LutraID talks to the wallet on your behalf, under its own access certificate, and forwards each result to your system without keeping it. Self-hosted installations always run Direct; the hosted service runs Intermediary.

The mode is set for the whole installation, not per verifier. It concerns verification; which certificates issuing needs is covered in Production setup.

Side by side

DirectIntermediary
Where it runsSelf-hostedHosted service
Who talks to the walletYour organizationLutraID, on your behalf
Access certificateEach verifier requests its own, on its Registration tabLutraID's, associated with your organization and service
Where shared values goKept by LutraID for a limited time; you read them over the APISent to your result endpoint, then discarded
What you set up for resultsNothing extraA result endpoint per verifier
Your registrationYour organization and its servicesYour organization and its services, linked to LutraID as intermediary

Which one applies to you

The regulatory role follows who interacts with the wallet and on whose behalf, not who pays or where the software runs. When you self-host LutraID and run the checks yourself, you are a relying party acting directly. When you use the hosted service, LutraID connects to wallets and requests information for you, so it is your intermediary and you are an intermediated relying party.

Choose self-hosting if the information people share must stay in your own infrastructure, or if you need your own access certificates. Choose the hosted service if you would rather not run the software or hold wallet data at all.

In the regulation and the ARF

Last updated: 26 October 2026.

Was this page helpful?