A method comprising: receiving (S202), by a server computer from a relying entity computer associated with a relying entity, a request for identity attributes associated with a target entity , wherein the request for identity attributes includes a session identifier, that is associated with the target entity and was generated by the relying entity in association with a communication session with the target entity , and an identifier of the relying entity , wherein the session identifier is derived from an identifier of the target entity and the identifier of the relying entity ; validating (S204), by the server computer , the request by comparing the session identifier to the identifier of the target entity to confirm that the session involves the target entity , wherein, if the server cannot validate the session identifier (S204, NO), the server refrains (S208) from proceeding to retrieve identity attributes; identifying (S210, 5212), by the server computer , based on the identifier of the relying entity , a package defining types of identity attributes for the relying entity and a data access token associated with the package; based on validating the request, transmitting (S214), by the server computer to a digital identity provider computer , a server request for a set of identity attributes corresponding to the package, the server request comprising the data access token; receiving (S216), by the server computer from the digital identity provider computer, the set of identity attributes; transmitting (S222), by the server computer to the relying entity computer , the set of identity attributes so that the relying entity can use the session identifier and the set of identity attributes to complete a task. receiving (S202), by a server computer from a relying entity computer associated with a relying entity, a request for identity attributes associated with a target entity , wherein the request for identity attributes includes a session identifier, that is associated with the target entity and was generated by the relying entity in association with a communication session with the target entity , and an identifier of the relying entity , wherein the session identifier is derived from an identifier of the target entity and the identifier of the relying entity ; validating (S204), by the server computer , the request by comparing the session identifier to the identifier of the target entity to confirm that the session involves the target entity , wherein, if the server cannot validate the session identifier (S204, NO), the server refrains (S208) from proceeding to retrieve identity attributes; identifying (S210, 5212), by the server computer , based on the identifier of the relying entity , a package defining types of identity attributes for the relying entity and a data access token associated with the package; based on validating the request, transmitting (S214), by the server computer to a digital identity provider computer , a server request for a set of identity attributes corresponding to the package, the server request comprising the data access token; receiving (S216), by the server computer from the digital identity provider computer, the set of identity attributes; transmitting (S222), by the server computer to the relying entity computer , the set of identity attributes so that the relying entity can use the session identifier and the set of identity attributes to complete a task. <EOS>