Definition

sdkId is the unique identifier the Wallet SDK assigns to a device installation. It is generated during onboarding and always changes when the SDK is re‑activated (re‑onboarding).

Lifecycle

• Created: When the SDK is onboarded on a device.
• New on every onboarding: Any onboarding/re‑onboarding (incl. reinstall on same device) → new sdkId.
• No reuse: The sdkId is fixed, i.e. the sdkId is never re-issued in another onboarding.
• Multiple devices: Each device/installation produces its own sdkId.

Behavior in Key Scenarios

Relationship to Other Identifiers

• Subject (sub): Identity of the person (derived from the auth provider signature, e.g., BankID/itsme).
  • Scope: Unique per Wallet Provider.
  • Stability: Same person + same WSP → same Subject, even after many re‑onboardings.
  • Different Wallet Provider → different Subject (prevents cross‑Wallet Provider correlation).
• sdkId: Device instance identifier. Multiple sdkIds can exist under one Subject (e.g., multiple devices or re‑onboardings).

Device Management

Supported actions:

1. Revoke single device → Revoke the specified sdkId.
2. Revoke all devices → Revoke all sdkIds linked to the Subject (for that Wallet Provider).
3. Delete Wallet → Delete the wallet, revoke all sdkId, and remove all payment methods in the wallet.

Notes

• Use Subject + sdkId for precise device targeting.
• “Delete Wallet” is a full de‑provisioning action.

Events

• Each onboarding (and thus each new sdkId) triggers an Onboarding event that includes the new sdkId.
• Transaction‑related events may include sdkId for device correlation (when applicable).
• Event payloads should be treated as the source of truth for the current device‑to‑person linkage.

Best Practices

1. Treat sdkId as ephemeral per onboarding (not a permanent person identifier).
2. Use Subject (per WSP) for person‑level identity; use sdkId for device‑level controls.
3. Prefer revoke single device for compromised/lost devices; use revoke all for account compromise scenarios.
4. Use Delete Wallet only when the person requests full de‑provisioning (data and devices).