Client authentication#

Relying Parties (RP) must authenticate with BankID for server-to-server calls such as the token and introspect endpoints.

Among the standardized authentication methods⁠ (opens in a new tab) the following is recommended:

• private_key_jwt⁠ (opens in a new tab) in accordance with standards⁠ (opens in a new tab). Read more about this method.

We also support:

• client_secret_basic⁠ (opens in a new tab) according to OAuth2⁠ (opens in a new tab) using the HTTP Basic authentication⁠ (opens in a new tab) scheme.
• client_secret_post⁠ (opens in a new tab) according to OAuth2⁠ (opens in a new tab) by including the Client Credentials (client_id and client_secret) in the request body.