# Authentication

## Credentials

To authenticate with Id-Card in BankID-app API, you use a Token obtained from the BankID OIDC API by exchanging a `client_id`, `client_secret` and `scope` grant. This uses the OAuth `client_credential` flow and you can read more about it [here](https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/).

> **Note**
>
> Apply for access through our [STØ Portal](https://portal.stoe.no)

## API Authentication with OIDC Token

To successfully get an OIDC Token to authenticate to our API,  build the authorization endpoint URI by adding the following parameters:

- `grant_type:client_credentials`
- `client_id`: The Client ID for your BankID OIDC Token
- `client_secret`: The Client Secret for your BankID OIDC Token
- `scope`: Specifies the requested information about a user

> **We support using multiple scopes as a space-separated list.**

**Example of a valid OIDC token request**

```properties
POST https://auth.current.bankid.no/auth/realms/current/protocol/openid-connect/token
    ?grant_type=client_credentials
    &client_id=visleg-test-froggy-bankid-current
    &client_secret=7qO828HQvQBZ1lJnOHPMQ0TJSaWv4U28
    &scope=vis-leg/identity_basic
```

**Example of a valid OIDC token response**

```json
HTTP/1.1 200 OK
Content-Type: application/json
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiS(...)",
"expires_in": 300,
"refresh_expires_in": 0,
"token_type": "bearer",
"not-before-policy": 0,
"scope": "vis-leg/identity_full"
}
```

> **Cache the Authentication Token for use until it expires, at which point obtain a new token.**

## Usage

The authentication Token should be supplied in the `Authorization` header when making calls to ID-Card in BankID-app API.

**Example of a valid  request**

```properties
POST https://visleg-test-merchantservice-cnhvehb0cvdgggah.z01.azurefd.net/api/merchant/session
    ?Authorization=Bearer eyJhbGciOiJSUzI1NiIsInR5c(...)
    &Content-Type application/json

Body
    {
        "sessionId": "VisLeg-50f9cc4a-1354-4d57-88d8-e9a428e1016b"
    }
```