Simple signing#

The simplified flow can be used for text signing and is initiated by parameters in the authorization request:

• sign scope in the list of scopes in scope parameter
• sign_txt with the text to be signed (less than 150 chars) as Base64 encoded UTF-8 string

Steps#

1. 1

   The user requests signing from your service.

2. 2

   You redirect the user to the BankID authorize endpoint with the sign scope and the text to be signed in sign_txt.

3. 3

   The user signs the text.

4. 4

   BankID sends the signed text back to your service in the ID token.

5. 5

   Your service verifies the token and extracts the signed text.

Sequence diagram#

sequenceDiagram
    actor u as User
    participant Merchant as Your Web App
    participant BankID as BankID
    u ->> Merchant: Request signing
    Merchant->>BankID: GET /authorize?scope=sign&sign_txt=base64encoded(utf8-string)&client_id=...
    BankID-->> Merchant: Redirect to callback with code
    Merchant->>BankID: POST /token with code
    BankID-->>Merchant: ID token with `sign_result` claim
    Merchant->>u: Signing complete

API#

Request#

GET [authorize_endpoint]... &scope=sign&sign_txt=base64encoded(utf8-string)

Result#

The results come in the ID token as a claim named sign_result:

{
  "typ": "ID",
  "sub" : "12c2b-...",
  ...
  "sign_result" : {
    "endUser" : "MIAGC...",
    "merchant" : "MIAGC...",
    "hash" : "4oK3g..."
  }
}

The result contains the basic signatures of the merchant and end user, as well as the hash over the received text.

Remember to verify the token signatures and signing keys.