For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Changes for Swedish BankID

This page describes the changes specific to Swedish BankID that are required when migrating an existing OIDC integration from Signicat Enterprise to the new Signicat Digital Trust Platform (DTP).

Overview​

  • Swedish BankID authentication works the same after migration.
  • The end-user authentication flow does not require any changes specific to Swedish BankID.
  • The main migration changes affect:
    • OIDC configuration, including your endpoints and client credentials.
    • Returned OIDC claims, including the Swedish national identity number.
    • Identity method selection (if used).

Claims​

For an overview of the key claim changes, see the table below:

Note

The standard claims name, given_name, family_name, birthdate and gender remain unchanged.

For a complete list of Swedish BankID claims, see the Attributes reference page.

Scopes​

When migrating Swedish BankID, we recommend using the same set of scopes as in your current integration, while applying the mapping of the scope codes. For example, if you currently use openid, profile and signicat.national_id, we recommend that you replace signicat.national_id with nin thus resulting in openid, profile and nin. This ensures that you receive the equivalent user information.

Example: Scopes
openid profile nin
Our recommendation

We recommend that you only use additional Swedish BankID scopes if your application already depends on them.

The exact claims returned depend on the requested scopes and your OIDC client configuration.

You can find an example of how an OIDC authentication response and the scopes used differ between Enterprise and our new platform below:

Example: Enterprise OIDC scopes
openid+profile+signicat.national_id
Example: Enterprise response
{
  "sub": "<enterprise_subject_id>",
  "birthdate": "1976-11-19",
  "name": "Marcus Johnsson",
  "signicat.national_id": "<national_identity_number>",
  "given_name": "Marcus",
  "locale": "SV",
  "family_name": "Johnsson"
}

Required application changes​

Update your application to read the Swedish national identity number from the new platform claim nin, instead of the Enterprise signicat.national_id claim:

Enterprise claim
signicat.national_id

If your application uses the OIDC sub claim as an internal user identifier, then you must verify your identifier mapping before migration.

Note

The sub claim is still returned by our new platform, but the value may differ from the Enterprise value.

If you need to retrieve the identical subID value, then you can follow the Migrating from Enterprise documentation.

ACR values​

The acr_values parameter is optional. You should only use it if your application pre-selects Swedish BankID or controls a specific Swedish BankID flow.

Pre-select Swedish BankID and control authentication flow​

To pre-select Swedish BankID in our new platform, set idp:sbid in the acr_values.

Starting default Swedish BankID flow
acr_values=idp:sbid

To specify which authentication flow to use, you must also include it in the acr_values parameter. The examples below show how to predefine the flow to either display a QR code or launch the app on the same device.

Starting Swedish BankID QR code flow
acr_values=idp:sbid sbid_initial_flow:REMOTE_FLOW
Starting Swedish BankID app launch flow
acr_values=idp:sbid sbid_initial_flow:APP_LAUNCH
Note

If you do not specify sbid_initial_flow in the acr_values, then the default behaviour is used and the appropriate flow is selected automatically based on the end-user's device.

Advanced Swedish BankID flows​

For advanced flow options, see the Swedish BankID OIDC integration guide. This includes:

  • Phone flow.
  • MRTD.
  • Intention text.
  • App redirects.
  • iOS redirect behaviour.

Test before cutover​

Migrating Swedish BankID authentication to our new platform has a low overall impact. End-users authenticate in the same way, and the returned OIDC response is largely similar.

Before production cutover, verify that your application can:

  • Complete a Swedish BankID OIDC authentication flow in our new platform.
  • Read the national identity number from nin instead of signicat.national_id.
  • Read name, given_name, family_name, and birthdate.
  • Handle any changes to the sub value if it is used as an internal identifier.
  • Pre-select Swedish BankID using acr_values=idp:sbid, if your application uses method pre-selection.
On this page