For the complete documentation index, see llms.txt

Set up DigiD pre-production

Initial preparations

To set up DigiD in pre-production, start with the steps described in the Initial preparations page.

1. Add DigiD in the Dashboard

When you want to use an eID, you first need to activate it in the Signicat Dashboard. To do this for DigiD, follow these steps:

For the complete documentation index, see llms.txt

1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
2. Click + Add new in the top right.
3. Choose the eID from the list. Then, fill in any required configuration and click Add.
4. Now, review that the eID is available and displayed as "Active" in the eIDs page.

Cannot activate DigiD?

If you cannot activate DigiD or require assistance, you can contact us by creating a support ticket in the Signicat Dashboard.

eID configuration

DigiD Dashboard settings

You can edit the settings of your DigiD connection:

• Strip sector code from nameID: Logius sends a prefix with the citizen service number (BSN). Some service providers can't handle that. Tick this checkbox to strip away the sector code/prefix.

Adjust the settings as necessary and click Save to apply the changes.

Advanced configuration

To configure advanced settings, go to the "Advanced" tab in the DigiD page and specify:

• Select attribute filter: Select an attribute filter to control which attributes you want to include, or exclude, from the response. To create attribute filters in the Dashboard, navigate to Products > eID and Wallet Hub > Advanced > Attribute filters.

• Include only when scoped: If ticked, DigiD will not be available as an eID for authentication on the eID selection screen, unless you specify it in your authentication request by using IdP scoping (DigiD scope: digid).

• Response attribute mappings: You can customise the name of the attributes received in the response body. Provide none or multiple name-to-name mappings.

• Use web flow on mobile device: When you configure DigiD for WEB flows, you may still want to offer authentication through mobile devices. It is important to note that sometimes authentications started in the DigiD app may redirect the user to the native browser of the mobile device. In such cases, we handle the redirect through "session restoration" which may lead to vulnerabilities that require additional security considerations.

  Security considerations

  We have taken a number of measures to reduce the security risks on our side. To ensure secure authentications, you need to take action on the implementation side. If you want to use web flows on mobile devices, you have to be aware of the risks and address them appropriately. For more information, you can read more below or contact us by creating a support ticket in the Signicat Dashboard.

  Mitigating risks

  To fully mitigate the residual risk, we recommend you implement the following measures on your side.

  Verify the response: You should accept a response back from Signicat only after you have matched the response to a request that you have sent previously. For example, you can achieve this by storing the request in the user session.

2. Get Signicat metadata

When you activate DigiD in the Signicat Dashboard, you can download the Signicat SAML metadata (in XML format). You need the Signicat metadata when applying for DigiD with Logius in the next step.

To get the metadata file:

1. In the Signicat Dashboard, navigate to Products > eID and Wallet Hub > eIDs.
2. Select DigiD from the list of active eIDs.
3. Select Get Signicat metadata to download the XML file to your device.

Save the downloaded metadata file locally. You will upload this file to Logius in the next step.

3. Request DigiD pre-production

To connect to DigiD pre-production, you need to fill in the Logius Aanvraagformulier (Application form). Learn more about how to do this in the Filling in the Logius Aanvraagformulier section below.

Waiting times

According to the Logius Roadmap, it takes about five working days to receive the connection details to the DigiD pre-production environment.

Filling in the Logius Aanvraagformulier

When filling in the Logius Aanvraagformulier (Application form), consider the following key fields:

Field	Recommended input or selection
Mijn organisatie is een (My organisation is a)	Select the type of your organisation: Overheidsorganisatie/overig (Government organisation/other) or Leverancier (third-party supplier).
Wilt u voor deze aansluiting een sub-OIN gebruiken? (Do you want to use a sub-OIN?)	Select Nee (No) to use your main Organisation Identification Number (OIN). Select Ja (Yes) only if you register a specific sub-OIN for this connection.
Op welke omgeving wilt u aansluiten? (Which environment do you want to connect to?)	Select Preproductieomgeving (Pre-production environment). You must always complete the pre-production setup before you apply for production.
URL aansluiting preproductieomgeving (URL pre-production connection)	Enter your application's pre-production endpoint URL where your end-users can start the authentication with DigiD. This must be a webpage on your own website that you set up yourself; do not enter the Signicat eID and Wallet Hub URL in this field. The page should contain a DigiD button linking to the authentication URL. The URL must begin with https://.
Dienstnaam (Service name)	Enter only the name of your service (for example, "Client Portal"). Logius combines this with your organisation name to show your users "Your Organisation - Client Portal".
Metadata in xml-formaat (Metadata in XML format)	Upload the Signicat SAML metadata XML file that you downloaded in the 2. Get Signicat metadata step.

4. Set up a connection with a protocol

To establish a connection between DigiD and your application, you need to use an authentication protocol.

Note that you only need to set up a connection to the Signicat eID and Wallet Hub servers. Signicat handles the connection with DigiD separately, therefore acting as a message broker between your application and DigiD.

Choose a protocol

For the complete documentation index, see llms.txt

Supported authentication protocols

Signicat supports the standard OpenID Connect (OIDC) and SAML 2.0 protocols. In addition, we offer our bespoke Signicat Authentication REST API.

The protocol you choose depends on your goals and preferences. The Authentication REST API provides flexibility and an easy setup. Otherwise, we recommend OIDC, since SAML 2.0 is much more complex to implement and usually requires a federation agent. OIDC is an industry standard with managed user sessions, unlike the Authentication REST API.

To learn more about these authentication protocols, see the Signicat eID and Wallet Hub documentation.

Set up the protocol

For information on how to set up the different protocols, see the eID and Wallet Hub - Quick start guide.

Data and attributes

To learn more about attributes, scopes and claims supported by each authentication protocol, visit the Attributes reference page.

5. Get your pre-production setup approved

After you set up the pre-production web/mobile service connection, you need to test it and submit a request for approval by Logius. Here are the steps to follow:

1. Test your implementation using the Checklist for connecting to DigiD.
2. Apply the necessary changes to meet the requirements.
3. Ask Logius to verify your integration by requesting a connection test with the form Aanvragen test DigiD-aansluiting (Request test DigiD connection) form.

Filling in the Logius Aanvragen test DigiD-aansluiting form

When you fill in the Logius Aanvragen test DigiD-aansluiting (Request test DigiD connection) form, consider the following key fields:

Field	Recommended input or selection
Aansluitnummer op de preproductie-omgeving (Connection number on the pre-production environment)	Enter the pre-production connection number that Logius sent to your organisation.
Naam van uw leverancier (Name of your supplier)	Enter Signicat. Signicat is your identity service provider.
Om welk koppelvlak gaat het? (Which interface is this about?)	Select SAML. Signicat connects to DigiD using the SAML 2.0 interface.
Webdienst URL (Web service URL)	Enter your application's pre-production endpoint URL where your end-users start the authentication with DigiD. This must be a webpage on your own website that you set up yourself; do not enter the Signicat eID and Wallet Hub URL in this field. The page should contain a DigiD button linking to the authentication URL. The URL must begin with https://.
Is deze omgeving beschikbaar voor Logius? (Is this environment available for Logius?)	Make a selection based on whether your environment is available for Logius to reach.
Voldoet de omgeving volgens u aan de voorwaarden? (Does the environment meet the conditions according to you?)	Select Ja (Yes). This confirms that you have tested your environment using the Logius checklist and found no issues.
Vanaf wanneer kunnen we testen? (From when can we test?)	Enter the date and time when Logius can begin testing your pre-production connection.
Gebruikersnaam testaccount / Wachtwoord testaccount (Username test account / Password test account)	Enter the username and password of the pre-production DigiD test account that Logius provided you. This allows Logius to log in during the test.

After Logius approves your pre-production connection, you are ready to integrate with DigiD in production.

Next step

4. Go to production

Connect to the DigiD production account