The best charging authentication is none at all: plug the cable in, walk away, and the right account gets billed. That's the promise of Plug & Charge, built on the ISO 15118 standard — and unlike many industry promises, the technology genuinely exists and works. What's nuanced is everything around it: certificates, ecosystems, hardware support, and where it actually fits among the ways drivers start a charge.
Here's the operator's-eye view.
How it works, in one pass
ISO 15118 defines rich communication between the vehicle and the charger — a different axis from OCPP (charger to backend) and OCPI (operator to market). For Plug & Charge specifically:
- The vehicle carries a contract certificate — a cryptographic identity issued when the driver signs up with an e-mobility provider, provisioned into the car.
- On plug-in, car and charger establish a secure session (TLS over the charging cable's communication line) and the car presents its certificate.
- The charger — and the backend behind it — validates the certificate against the issuing ecosystem's trust chain, resolves it to a billable contract, and authorises the session.
- Everything upstream then proceeds as normal: the session flows through the usual billing pipeline with the contract as the payer.
No RFID card, no app, no QR code. The car is the credential.
What it demands from the stack
From the charger: ISO 15118 hardware support on the charging interface (powerline communication), current firmware, and certificate-handling capability. This is standard on most new DC hardware and increasingly common on AC; it does not retrofit onto chargers that lack the hardware — which, for mixed fleets, makes Plug & Charge another per-model capability to inventory, not a flag to flip.
From the backend: certificate lifecycle machinery. OCPP 2.x carries the messages — certificate installation, status checks, the Authorize flow with certificate data — which is among the concrete reasons 2.x adoption matters beyond box-ticking. The backend must validate chains, handle revocation, and route contract identities to the right settlement relationships.
From the ecosystem: this is the part no single operator controls. Contract certificates come from PKI ecosystems that link vehicle makers, mobility providers and operators. Joining one is a commercial and operational decision — trust anchors to integrate, agreements to sign — and ecosystem coverage varies by market and manufacturer. The technology is standardised; the trust network is still consolidating.
The realistic adoption picture
An honest operator's read of where this sits:
- Plug & Charge is additive, not replacing. UK regulations require contactless on new rapid hardware precisely so nobody needs a relationship to charge. Fleet cards, RFID and apps all persist. Authentication is becoming a menu, and the operational requirement is supporting the menu cleanly — per session, per site, per audience.
- Where it shines first: fleets and depots. A depot where every vehicle authenticates itself eliminates the nightly "driver forgot to tap" failure mode entirely — and fleet vehicles are exactly where contract provisioning is an organisational decision rather than a consumer adoption curve.
- AC public charging is the long tail. Hardware capability, ecosystem coverage and consumer awareness all lag the DC rapid segment. Plan for years of coexistence.
Operational notes from the trenches
- Certificate expiry is the new failure mode. A vehicle whose contract certificate lapsed fails authentication with an error message the driver has never seen before. Support teams need this in their playbook — and outcome monitoring should distinguish "charger broken" from "authentication declined" or the reliability numbers lie.
- Fallback must be graceful. When Plug & Charge fails — expired cert, ecosystem outage, handshake quirk with a specific vehicle model — the charger should degrade to the next method (contactless, app) rather than to a dead session. Test this path deliberately; it's the difference between a shrug and a stranded driver.
- Vehicle interop is real work. Cars implement 15118 with the same variety chargers implement OCPP. Track vehicle-model quirks the way you track charger-model quirks; the matrix is smaller but just as real.
The takeaway
Plug & Charge is the rare industry feature that improves both driver experience and operational reliability — fewer authentication failures, fewer support calls, cleaner billing attribution. It rewards operators who've already done the unglamorous groundwork: OCPP 2.x capability, certificate handling, per-model capability inventories and honest fallbacks. Treat it as a capability you grow into across the fleet, prioritised where the payoff is immediate — and be suspicious of anyone selling it as a switch you flip.
AmpNexus supports certificate flows across OCPP 2.x alongside RFID, app and contactless authentication — see OCPP Connect or talk to us about your authentication mix.