---
title: "Get DigiLocker reference key"
method: POST
path: "/verify/digilocker/get_reference"
tags: ["DigiLocker"]
---

# Get DigiLocker reference key

`POST /verify/digilocker/get_reference`

Exchanges an authorization code and code_verifier for a short-lived reference_key used in subsequent DigiLocker operations. Requires X-API-KEY and X-Client-ID headers.

## Request body

- DigilockerGetReferenceRequest
  - `code` string, required — Authorization code received from DigiLocker after user consent.
  - `code_verifier` string, required — PKCE code_verifier used during the OAuth flow.

## Response `200`

Reference key generated

- DigilockerGetReferenceResponse
  - `status` string, required — Overall API response status
  - `reference_key` string, required — Short-lived reference key to use with DigiLocker fetch endpoints
  - `expires_at` string, date-time, required — ISO 8601 expiry timestamp for the reference_key (UTC)
  - `chargeble` string — Indicates if the operation is chargeable ('true'|'false')
  - `user_consent` string — Indicates whether user consent was recorded ('true'|'false')

## Other responses

- `400` — Invalid input or expired/invalid code
- `401` — Unauthorized - missing/invalid API key or client id
- `500` — Internal server error

---

[API](https://skmtc.dev/idto/apis/verification-api.md) · [All operations](https://skmtc.dev/idto/apis/verification-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/idto/verification-api/revisions/e3d57dab8db4/schema)