Authentication#

On this page

Credentials#

To authenticate with Id-Card in BankID-app API, you use a Token obtained from the BankID OIDC API by exchanging a client_id, client_secret and scope grant. This uses the OAuth client_credential flow and you can read more about it here⁠ (opens in a new tab).

API Authentication with OIDC Token#

To successfully get an OIDC Token to authenticate to our API, build the authorization endpoint URI by adding the following parameters:

grant_type:client_credentials
client_id: The Client ID for your BankID OIDC Token
client_secret: The Client Secret for your BankID OIDC Token
scope: Specifies the requested information about a user

Example of a valid OIDC token request

POST https://auth.current.bankid.no/auth/realms/current/protocol/openid-connect/token
    ?grant_type=client_credentials
    &client_id=visleg-test-froggy-bankid-current
    &client_secret=7qO828HQvQBZ1lJnOHPMQ0TJSaWv4U28
    &scope=vis-leg/identity_basic

Example of a valid OIDC token response

HTTP/1.1 200 OK
Content-Type: application/json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiS(...)",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "bearer",
"not-before-policy": 0,
"scope": "vis-leg/identity_full"
}

Usage#

The authentication Token should be supplied in the Authorization header when making calls to ID-Card in BankID-app API.

Example of a valid request

POST https://visleg-test-merchantservice-cnhvehb0cvdgggah.z01.azurefd.net/api/merchant/session
    ?Authorization=Bearer eyJhbGciOiJSUzI1NiIsInR5c(...)
    &Content-Type application/json

Body
    {
        "sessionId": "VisLeg-50f9cc4a-1354-4d57-88d8-e9a428e1016b"
    }