Step 5: Go Live as a Relying Party

Once your integration is tested end to end in the sandbox, register your application with Google to receive your signed production certificate and unique relying party metadata (gw_rp_metadata_bytes). This guide applies to Direct Relying Parties—apps and websites verifying users for themselves.

Start

Choose your path RP, Verifier Registrar, or In-Person

1
Set up the sandbox Allowlist account & switch device
2
Create a test ID Add a test ID pass to Wallet
3
Integrate Build by your path:
Relying Party→ Verifier Registrar→
4
Test integration Run E2E checklist & record video
5Here
Go live Launch by your path:
Relying Party✓ Verifier Registrar→

Steps on this page

A Prepare your submissionCSR, display assets & E2E video B Submit intake formSubmit form & accept RP ToS C Receive signed certReview takes 3–5 business days D Switch to productionDeploy prod cert, metadata & IACA roots

Step A: Prepare your submission

Before going live in production, Google uses a certificate signing process where Google signs your certificate to establish trust. Gather the following three items:

  1. Your production Certificate Signing Request (CSR): Generated from your production P-256 / ECDSA private key.
  2. Your display assets:
    • Display Name
    • Logo URL (must comply with the Brand Guidelines)
    • Privacy Policy URL
    • Terms of Service URL
  3. Your end-to-end sandbox demonstration video: Recorded after completing Step 4.D: Record your end-to-end demonstration video.

Step B: Submit the intake form & accept the Terms of Service

Fill out and submit the Relying Party Onboarding Form.

Open Relying Party Onboarding Form

Step C: Review & receive your production credentials

Onboarding review typically takes 3–5 business days. Once approved, Google provides you with:

  • Your signed production X.509 certificate.
  • Your unique Base64URL-encoded metadata string (gw_rp_metadata_bytes).

If you have not heard back after 5 business days, reach out to wallet-identity-rp-support@google.com.

Step D: Switch your server & device to production

Transition from sandbox test keys and Utopia root certificate to production credentials and official issuer root certificates

Update your verifier server and test device from sandbox to production:

  1. Replace your signing key and certificate: Sign OpenID4VP requests with your production private key and include your Google-signed production certificate in the JWS x5c header (Step 3.A).
  2. Update client_id: Recompute x509_hash:<base64url_sha256> from your production DER certificate.
  3. Update gw_rp_metadata_bytes: Replace the sandbox test metadata string in client_metadata with your production gw_rp_metadata_bytes.
  4. Configure production IACA root certificates: Ensure your server's trust store validates issuerAuth against the official production root certificates in Supported Issuers & IACA Certificates (and remove the Utopia Sandbox cert from production).
  5. Switch your test device back to PRODUCTION: Follow Step 1.C: Switch back to production and verify the production flow.

Related resources