Plug-and-charge is the best authentication experience in charging: the driver plugs in and the session starts, with no app, no card and no tag. The vehicle and the charger authenticate each other cryptographically over the charging cable, and the billing relationship is resolved behind that.
It is also a public key infrastructure, and that is the part operators underestimate.
What has to be true
- 01The vehicle must support ISO 15118 with plug-and-charge and carry a provisioning certificate. Support is spreading but far from universal, and it varies by trim and market.
- 02The charger must support high-level communication over the control pilot, which is a different physical capability from ordinary OCPP messaging.
- 03The charger must support OCPP 2.0.1, or a 1.6 extension, to move certificates and authorisation requests to your platform.
- 04Your platform must handle contract certificates, their validation and their renewal.
- 05A certificate authority chain has to exist that both the vehicle and your platform trust.
Miss any one and the driver falls back to an app or a tag — which is fine, provided you have designed the fallback rather than discovered it.
The Indian position
Passenger EVs sold in India with full ISO 15118 plug-and-charge support are still a small minority of the parc, and the certificate ecosystem is not yet established locally. That makes plug-and-charge a roadmap item for most operators rather than a current requirement.
What to build instead
Most of the experience benefit of plug-and-charge is available today with far less machinery. An autocharge-style approach — recognising the vehicle by an identifier presented at session start and matching it to a known driver — gets you plug-in-and-go for repeat drivers at a fraction of the effort.
It is not cryptographically authenticated, so it is not appropriate where the identifier can be spoofed and the amounts are large. For a fleet depot or a residential society, where the vehicles are known and the risk is negligible, it is the right answer and it works with hardware you already own.
Design the platform for it anyway
Authorisation should already be a pluggable decision — a tag, an app, a vehicle identifier, a contract certificate, all resolving to the same internal question of whether this driver may start this session at this price. Where that boundary exists, adding 15118 later is an integration. Where it does not, it is a rewrite.