In order to use eID Hub with OpenID Connect you need to request a client account from Scrive.

The following details are needed to set up an account:

The name of the company.
The eID providers to enable.
A redirect-URI.

Example

An authentication request can look like this:

https://testbed-eid-oidc.scrive.com/oauth2/auth? response_type=code &scope=openid+profile &client_id={your-client-id} &redirect_uri={your-registered-redirect-uri} &state={state-parameter-generated-on-your-side} &prompt=login &provider=bankid_se &ui_locales=en &reference_text=Identify+to+login+to+My+Company

See detailed description of all parameters allowed in an authentication request below.

Providers

Besides the standard OAuth2 parameters, the authorisation endpoint expects a provider parameter, to allow selecting the eID provider for the authentication.

The supported providers are:

eID provider	Parameter
BankID (Sweden)	bankid_se
FTN	ftn
BankID (Norway)	bankid_no
NemID	nemid
Verimi	verimi
iDIN	idin
Itsme	itsme
SMS OTP	sms_otp
Freja	freja
MitID	mitid
NemID or MitID	nemid_or_mitid
SmartID	smart_id
Digidentity	digidentity

Localisation

You can select a locale through the ui_locales query parameter on the authorisation endpoint.

Only 2-letter language tags are accepted (no region subtag). For example: nb, da, en.

The supported languages depend on the selected eID provider. Not all providers support the choice of a locale. See table below for more details.

Scope

The authorisation endpoint accept the standard scope query parameter to request specific scope values.

The following scope values are supported:

openid (mandatory to enable the OpenID Connect flow)
profile
email
address
phone
ssn

Prompt

The login session is stored in a cookie which makes it possible to remember the session in the user’s browser for a short time (under 5 minutes). If you don’t want the session to be re-used, add prompt=login parameter. In case you want to make sure the session is re-used prompt=none can be added, however remembering sessions also happens automatically in case there is a corresponding cookie.

Reference text

The query parameter reference_text can be set to specify the text shown to the end-user. If it’s not specified, a default value is used. See the summary below of what providers allow a configurable reference text and its form.

eID provider	RegEx	Default
MitID	`^.{1,130}$`	“-”
NemID	`^.{1,100}$`	""
iDIN	`^[-0-9a-zA-ZéëïóöüÉËÏÓÖÜ€ ()+,.@&=%"'/:;?$]{0,35}$`	“Identificatie”
Smart-ID	`^.{0,60}$`	""
SMS OTP	`^.{0,70}$`	“Your one-time code is”

Level of Assurance

The query parameter loa can be set to specify the level of assurance for providers that support multiple ones. Unsupported value would result in the default value.

eID provider	Supported values	Default
MitID	`low, substantial, high`	`substantial`
BankID (Norway)	`substantial, high`	`high`

Personal number

One could preset it via personal_number for providers where it is not considered sensitive.

eID provider	Format
BankID (Sweden)	12-digit

Employee login

One could preset the usage of employee login for providers that support it via the boolean parameter employee_login=true. Currently only supported for MitID.

Phone number

One could preset the phone number (MSISDN) via msisdn parameter. Must be in the international format, e.g. +441234567890. Currently only supported for SMS OTP.

Claims

sub

Always present, independently of the selected eID provider and the requested scope. It is a unique identifier for the authenticated user. In case the upstream provider uses OIDC protocol, we bypass the same sub claim from them.

provider

Always present, reflects the actual provider used for the authentication. Is necessary when using nemid_or_mitid provider to know which one of the two the end user has chosen.

provider_unique_id

Always present, in most cases coincides with the sub claim. However might contain some differences due to the fact that the upstream provider might add some prefixes in the sub claim or use a different internal ID, whereas this claim represents the exact value mirroring the unique user ID for the selected eID.

Provider	Corresponding unique ID
BankID (Sweden)	Personal number
FTN	PID
BankID (Norway)	PID
NemID	PID / CVR (for employee login)
Verimi	User ID
iDIN	CustomerID-BIN
Itsme	User ID
SMS OTP	Phone number
Freja	Relying-Party User ID
MitID	User ID
NemID or MitID	PID or UserID
SmartID	Personal code (semantic format)
Digidentity	User ID

Other claims

The other available claims depend on the provider and the scope. See the provider-specific settings for further details.