A method comprising: receiving, by a server computer from a relying entity computer associated with a relying entity, a request for identity attributes associated with a target entity, wherein the request for identity attributes includes a session identifier, that is associated with the target entity and was generated by the relying entity in association with a communication session with the target entity, and an identifier of the relying entity, wherein the session identifier is derived from an identifier of the target entity and the identifier of the relying entity; validating, by the server computer, the request by comparing the session identifier to the identifier of the target entity to confirm that the session involves the target entity, wherein, if the server cannot validate the session identifier (S204, NO), the server refrains from proceeding to retrieve identity attributes; identifying (S210, 5212), by the server computer, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package; based on validating the request, transmitting, by the server computer to a digital identity provider computer, a server request for a set of identity attributes corresponding to the package, the server request comprising the data access token; receiving, by the server computer from the digital identity provider computer, the set of identity attributes; transmitting, by the server computer to the relying entity computer, the set of identity attributes so that the relying entity can use the session identifier and the set of identity attributes to complete a task. receiving, by a server computer from a relying entity computer associated with a relying entity, a request for identity attributes associated with a target entity, wherein the request for identity attributes includes a session identifier, that is associated with the target entity and was generated by the relying entity in association with a communication session with the target entity, and an identifier of the relying entity, wherein the session identifier is derived from an identifier of the target entity and the identifier of the relying entity; validating, by the server computer, the request by comparing the session identifier to the identifier of the target entity to confirm that the session involves the target entity, wherein, if the server cannot validate the session identifier (S204, NO), the server refrains from proceeding to retrieve identity attributes; identifying (S210, 5212), by the server computer, based on the identifier of the relying entity, a package defining types of identity attributes for the relying entity and a data access token associated with the package; based on validating the request, transmitting, by the server computer to a digital identity provider computer, a server request for a set of identity attributes corresponding to the package, the server request comprising the data access token; receiving, by the server computer from the digital identity provider computer, the set of identity attributes; transmitting, by the server computer to the relying entity computer, the set of identity attributes so that the relying entity can use the session identifier and the set of identity attributes to complete a task.