For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

oidc

For the complete documentation index, see llms.txt

OpenID Connect (OIDC)

The following sections describe how to set up authentication with OIDC. Instructions are generic and agnostic of any programming language. For a more detailed guide with language-specific examples, see the Code examples for OIDC.

To get started with OIDC, follow these steps:

  1. Register an OIDC client in the Signicat Dashboard
  2. Find your Discovery and issuer URL
  3. Build an authentication request

You can find more details about each step below.

1. Register an OIDC client

Before you can start authenticating users, you must register an OIDC client application in the Signicat Dashboard. An OIDC client comes with a Client ID. Depending on the authentication grant type (flow) you want to implement, you may associate a secret to the client.

To register your OIDC client application in the Signicat Dashboard, do the following:

  1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > OIDC clients.
  2. Select Add client.
  3. Configure your OIDC client with these settings:
    • Primary grant type: Choose the grant type you want to implement. We strongly recommend AuthorizationCode (Authorization Code flow). Learn more about OIDC grant types in the to the OIDC specification and the OAuth 2.0 specification.
    • Create client from template: Optional. Allows you to use a template to prefill your client configuration. Skip this if you want to customise your configuration.
    • Client name: Enter a name for the client.
    • Redirect URI: Enter the URL where you want to redirect your end-user after they authenticate with an eID. Note that you can add several redirect URIs after you create the client.
    • Scope: Select the scopes for the type of data you want to retrieve with this client. openid is mandatory. profile and nin are necessary in most cases. You can see the definition of profile and other predefined scopes in the OIDC specification. You find scope definitions in the specific eIDs documentation.
  4. Select Create to create the new client.

Congratulations, you have created an OIDC client!

2. Find your Discovery and issuer URL

Depending on how you want to implement your app, you can find:

  • The discovery URL: https://<YOUR_SIGNICAT_DOMAIN>/auth/open/.well-known/openid-configuration. For example, if your domain is https://verybigcorp.signicat.com, your discovery URL is https://verybigcorp.signicat.com/auth/open/.well-known/openid-configuration.
  • The issuer URL: <YOUR_SIGNICAT_DOMAIN>/auth/open/. For example, your issuer URL would be https://verybigcorp.signicat.com/auth/open/.

3. Build an authorisation request

To start authenticating your end-users, your application must direct them to the authorisation endpoint (https://<YOUR_SIGNICAT_DOMAIN>/auth/open/connect/authorize) with the appropriate parameters.

At a minimum, your OIDC authorisation request must include:

  • client_id: The unique ID of your OIDC client that you registered in the Signicat Dashboard.
  • response_type: The OAuth response type that determines the authorisation flow and response parameters. Use code for the Authorization Code flow.
  • redirect_uri: The URL of your website or application where Signicat redirects end-users after they authenticate.
  • scope: Must include openid and any other scopes for attributes that the eID supports.
  • state: A random value that protects your application against Cross-Site Request Forgery (CSRF).
  • nonce: A random value to secure the integrity of your ID token. You need to compare the returned nonce claim with the value sent in the request.
  • prompt: Optional. Forces your end-users to re-authenticate every time, bypassing any active Single Sign-On (SSO) cookies or sessions.

Example authorisation request (line breaks included for readability):

https://<YOUR_SIGNICAT_DOMAIN>/auth/open/connect/authorize?
    &client_id=sandbox-example-client-123
    &response_type=code
    &redirect_uri=https://myservice.example/redirect
    &scope=openid
    &acr_values=<ACR_VALUES>
    &state=af93kslz
    &nonce=bn28sjdp
    &prompt=login

Your next steps depend on the type of OIDC flow you want to use. After your end-users authenticate, you can retrieve the results from the ID token and from the UserInfo endpoints.

Next steps

This guide introduced how the eID and Wallet Hub works in a nutshell. Next, we recommend learning more about OIDC and exploring the eIDs documentation.

OIDC
Find out more about OIDC, the authentication protocol based on the OAuth 2.0 protocol
Supported eIDs
View and learn how to integrate with the eIDs