# Simple signing

> **This feature is deprecated**
>
> The Simple Text sign is being removed. A new solution based on [Permissions](https://docs.stoe.no/bankid-with-biometrics/permission-types.md) will be announced soon.

The simplified flow can be used for text signing and is initiated by parameters in the authorization request:

- `sign` scope in the list of scopes in `scope` parameter
- `sign_txt` with the text to be signed (less than 150 chars) as Base64 encoded UTF-8 string

## Steps

1. The user requests signing from your service.
2. You redirect the user to the BankID authorize endpoint with the `sign` scope and the text to be signed in `sign_txt`.
3. The user signs the text.
4. BankID sends the signed text back to your service in the ID token.
5. Your service verifies the token and extracts the signed text.

## Sequence diagram

```mermaid
sequenceDiagram
    actor u as User
    participant Merchant as Your Web App
    participant BankID as BankID
    u ->> Merchant: Request signing
    Merchant->>BankID: GET /authorize?scope=sign&sign_txt=base64encoded(utf8-string)&client_id=...
    BankID-->> Merchant: Redirect to callback with code
    Merchant->>BankID: POST /token with code
    BankID-->>Merchant: ID token with `sign_result` claim
    Merchant->>u: Signing complete
```

## API

### Request

```
GET [authorize_endpoint]... &scope=sign&sign_txt=base64encoded(utf8-string)
```

### Result

The results come in the ID token as a claim named `sign_result`:

```json
{
  "typ": "ID",
  "sub" : "12c2b-...",
  ...
  "sign_result" : {
    "endUser" : "MIAGC...",
    "merchant" : "MIAGC...",
    "hash" : "4oK3g..."
  }
}
```

The result contains the basic signatures of the merchant and end user, as well as the hash over the received text.

Remember to [verify](https://docs.stoe.no/bankid-oidc-provider/advanced-topics/verify-token.md) the token signatures and signing keys.