For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

Quick start guide

Learn how to migrate your integration from Signicat Enterprise to the new Signicat Digital Trust Platform (DTP), using the Signicat Dashboard.

In this guide, you will learn how to:

  • Set up your new environment in the Signicat Dashboard.
  • Test your integration in sandbox
  • Prepare for production cutover.
Documentation scope

The scope of this page covers the migration journey and how to get set up in the Signicat Dashboard.

For integration changes specific to a particular protocol, see the relevant migration guides linked at the bottom of this page.

1. Open your sandbox account​

You need to accept your invitation to the Signicat Dashboard and open your sandbox account. To do this:

  1. Locate and open the Signicat Dashboard invitation email that we sent you.
  2. Click the link in the email to accept the invitation.
  3. In the Signicat Dashboard, ensure that the sandbox account created for your migration is selected in the top navigation bar. If not, expand the dropdown menu, then select the sandbox account.
Note

The sandbox account is what you will use to configure and test your new integration before making any production changes.

2. Set up your domain​

You need to set up a domain for your account. This can be either a standard domain or a custom domain, as summarised in the table below.

What is a domain used for?

A domain is a pointer to the Signicat operational environment that determines the URL at which Signicat products and metadata are available.

Standard and custom domains offer the same technical capabilities; the choice between them is only a matter of preference.

To learn more, see our Domains documentation.

Choose your domain type
  • To set up a standard domain, see the steps in the Standard domain section below.
  • To set up a custom domain, see our Custom domain documentation (outside of this guide).

Standard domain​

You can set up a standard domain for your account in the Signicat Dashboard. To do this:

  1. Go to Signicat Dashboard > Settings > Domains.
  2. Click the + Add domain button.
  3. In the Choose your domain type dialogue box, click the Standard domain button. This takes you to the Add standard domain page.
  4. In the Domain name field, enter your desired domain name, then click the Add domain button.
  5. Optionally, you can set this as your default domain by clicking the Set as default button.
  6. From the domain overview, ensure that your domain is marked with DNS status Ready.
Important

Remember to update your application's code and configuration to point to the standard domain address that you have created.

3. Create a connection​

You need to create a connection using an authentication protocol. This can be either OIDC, Authentication REST API or SAML 2.0, as summarised in the table below.

What is an authentication protocol used for?

An authentication protocol is used to set up a connection between your application and the eID and Wallet Hub, allowing you to authenticate your end-users using eIDs or wallets.

When integrating with our new platform, we recommend using OIDC (OpenID Connect) or our REST-based Authentication API. If you currently use SAML, we recommend migrating to one of these authentication protocols moving forward.

Choose your authentication protocol
  • To set up a connection using the OIDC authentication protocol, see the steps in the OpenID Connect (OIDC) section below.
  • To set up a connection using the Authentication REST API authentication protocol, see our Authentication REST API documentation (outside of this guide)
  • To set up a connection using the SAML 2.0 authentication protocol, see our SAML 2.0 documentation (outside of this guide)

OpenID Connect (OIDC)​

You can set up a connection using the OIDC authentication protocol in the Signicat Dashboard. To do this:

  1. Go to Signicat Dashboard > Products > eID and Wallet Hub, then select OIDC clients from the left-side menu.
  2. Click the + Create client button.
  3. Complete the fields as shown in the table below:
    FieldDescription
    Primary grant typeSelect Authorization code flow, unless your integration requires another type of flow.
    Create client from templateYou do not need to update this field. No template can remain selected.
    Client nameEnter a name for your client. This is shown to end-users on consent screens, and may appear in other places as well.
    Redirect URIAdd the redirect URI for your application. This is where your end-user will be redirected after authentication, and so it must exactly match the URI used by your application.

    Note: This must be HTTPS and an absolute URI. You can add more URIs once the client is created.
    ScopeSelect the required scopes that you want to add from the dropdown menu. The openid scope is mandatory.

    Example: For example, you could add nin and profile.
    Tip

    The scope nin is equivalent to the scope signicat.national_id on our enterprise platform.

  4. Click the Create button.
  5. Click the Add secret to create one. This takes you to the Secrets tab on the client details page.
  6. Select + Add secret to create a secret.
  7. Enter a name for the client secret, then select Generate secret.
  8. Copy and store both the client ID and the client secret securely. This is the only time that you can view the client secret in clear text.
Important

You should never include a client secret in frontend code or an authorisation request.

Want to learn more?

To learn how to make additional client configurations, see our OpenID Connect documentation.

4. Add eID methods​

You need to add eID methods for your integration. To do this:

  1. Go to Signicat Dashboard > Products > eID and Wallet Hub, then select eIDs from the left-side menu.
  2. Click the + Add new button.
  3. From the list of eIDs, click an eID that you would like to add, then click the Add button.
  4. From the eID overview, ensure that the eID is marked with status Active.
  5. Repeat steps 1-4 until you have added all the eIDs that you want for your integration.
  6. From the eID overview, you can optionally click the Test eIDs button to test an eID before connecting your application.
Production configuration

For production, some eIDs may require additional configuration by Signicat. This is explained in the Create and configure production section in this guide.

5. Update your application​

Update your application to use our new platform. Typical changes include:

  • Domain
  • Endpoints
  • Client credentials
  • Scopes
  • Claims
  • eID-selection parameters
Note

The updates highlighted below show the key changes that you need to make if you are using the OIDC authentication protocol. The exact changes depend on your account configuration.

For method-specific and protocol-specific changes, see the Related documentation section at the bottom of this page.

OpenID Connect (OIDC)​

If you are using the OIDC authentication protocol, then you need to make the following key changes:

Endpoints​

You can find an overview of the main OIDC endpoint changes between Enterprise and our new platform below:

Tip

Where possible, configure your OIDC library using the discovery URL for our new platform, instead of hardcoding the individual endpoints.

Discovery endpoint for Enterprise
https://preprod.signicat.com/oidc/.well-known/openid-configuration
Authorization endpoint for Enterprise
https://preprod.signicat.com/oidc/authorize
Token endpoint for Enterprise
https://preprod.signicat.com/oidc/token
UserInfo endpoint for Enterprise
https://preprod.signicat.com/oidc/userinfo

Request examples​

You can find an example of how an OIDC authentication request differs between Enterprise and our new platform below:

Example: Enterprise OIDC authentication request
https://preprod.signicat.com/oidc/authorize
  ?client_id=<ENTERPRISE_CLIENT_ID>
  &response_type=code
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
  &scope=openid%20profile%20signicat.national_id
  &acr_values=urn%3Asignicat%3Aoidc%3Amethod%3Anbid
  &state=<RANDOM_STATE>
  &nonce=<RANDOM_NONCE>
How to find the scoping code

You can see the scoping code for your eIDs at Signicat Dashboard > Products > eID and Wallet Hub, > eIDs. For a full list of codes, visit the eID scoping codes table.

6. Test in sandbox​

You need to test the complete authentication flow from your application in sandbox. To do this, you must confirm that:

  • The application starts authentication through the domain for new platform.
  • The end-user is routed to the correct eID method.
  • Authentication completes successfully.
  • The end-user returns to the correct redirect URI.
  • The application exchanges the Authorization code successfully.
  • The expected claims are returned.
  • The application can read nin where it would previously parse signicat.national_id .
  • Cancellation and failed authentication are handled correctly.
Important

For sandbox, you should only use test identities and test data.

7. Create and configure production​

After sandbox testing is complete, you can create and configure the production account.

Tip

Production follows the same configuration process as in the sandbox account. However, all domains, credentials, endpoints and eID configurations are production-specific and must be configured accordingly.

  1. Open or create your production account in the Signicat Dashboard.

    • If you already have one, then you need to select it from the dropdown menu in the top navigation bar.
    • If you do not have one, then you need to create one using the steps below.
    How to create a production account

    To create a production account, follow the steps below:

    1. Go to Signicat Dashboard > Organisation.
    2. Click the + Add account button.
    3. In the Organisation field, ensure that the correct organisation is shown.
    4. In the Account name field, enter a name for your production account.
    5. Select the Production account option.
    6. Click the Create button.

    Note: If the production account option is unavailable, then you need to complete your company's contact information.

    To do this, click the Complete information link, then add the following key contacts:

    • Commercial owner
    • Main technical contact
    • Financial contact

  2. Once the production account is available, repeat steps 2-5 of this guide, but using production-specific values instead:

    • Configure a standard or custom production domain.
    • Create the same connection type used in sandbox.
    • Configure the production redirect URIs, scopes, and other required settings.
    • Generate and securely store the new production credentials.
    • Request that your Migration Manager configures the production eIDs.
    • Update the application with the production configuration.
    Production domain suffix

    A standard production domain uses the .app.signicat.com suffix instead of .sandbox.signicat.com.

8. Complete production testing and cutover​

After your Migration Manager confirms that the production eIDs are ready, you need to do the following:

  1. Update your application with the production configuration for our new platform.
  2. Run a controlled production authentication test.
  3. Verify the redirect and returned claims.

Cutover checklist​

Before switching all traffic, ensure that:

  • The production connection is configured.
  • The required eIDs are configured and verified by your Migration Manager.
  • Production testing has passed.
  • A rollback plan is available.
Important

Keep the Enterprise configuration available until the production integration for our new platform has been confirmed as stable.

Common issues​

For a list of common issues and potential fixes, see the table below:

IssueWhat to check
An eID works in sandbox but not in productionAsk your migration manager whether production activation, certificates, or additional configuration are still required.
The end-user sees an eID-selection screen instead of going directly to the eID landing page.Verify the ACR values for our new platform.

Example: acr_values=idp:nbid.
The national identity number is missing.Confirm that the required scope is requested, and that the application reads nin.
Authentication fails with the new client.Check that the application is not mixing sandbox and production domains, client IDs, secrets, or endpoints.

Next steps​

To learn about changes specific to the eIDs that you are using, make a selection using the buttons below:

Changes for Norwegian BankID
Learn about migration changes specific to Norwegian BankID
Changes for Swedish BankID
Learn about migration changes specific to Swedish BankID
Changes for MitID
Learn about migration changes specific to MitID
Changes for Finnish Trust Network (FTN)
Learn about migration changes specific to Finnish Trust Network (FTN)

To learn about related topics, make a selection using the buttons below:

Signicat Dashboard​

Signicat Dashboard documentation
Learn about the Signicat Dashboard
Domains
Learn how to add and manage standard Signicat domains and custom domains
Company registration
Learn how to complete the company registration process

Protocol-specific information​

Changes for OIDC
Learn about migration changes specific to OIDC
OIDC
Learn about the OIDC authentication protocol
Authentication REST API
Learn about the Signicat Authentication REST API authentication protocol
SAML 2.0
Learn about the SAML 2.0 authentication protocol
On this page