Overview

Ver.iD Authentication is an OpenID Provider. It lets customers sign in to your platform with a digital identity wallet through a standard OpenID Connect client.

Authentication uses the Authorization Code flow. Ver.iD only supports the code response type for this flow.

Tokens

The token endpoint returns two tokens with different purposes:

Token	Format	Purpose
ID token	Signed JWT	Authenticates the customer and contains identity claims. Validate it before using its claims.
Access token	Opaque bearer token	Authorizes a request to the UserInfo endpoint. Do not decode it or use it as proof of identity.

Authentication flow

Create a new login transaction with a random state, nonce, and PKCE code verifier.
Redirect the customer to the authorization endpoint. Send response_type=code, scope=openid with at least one configured scope, the redirect URI, state, nonce, and an S256 PKCE code challenge.
The customer chooses a digital identity wallet and completes the authentication request.
Ver.iD returns an authorization code and the original state to your redirect URI.
Compare the returned state with the value stored for the login transaction. Stop if they do not match.
Exchange the code at the token endpoint. Send the PKCE code verifier. Confidential clients must also authenticate with their client secret.
Ver.iD returns an ID token and an access token.
Validate the ID token before creating a session or using any claims.

Client security

Use S256 PKCE for every client.

Client type	Requirements
Public client	Use PKCE. A public client cannot keep a client secret.
Confidential client	Keep the client secret on a trusted server. Use PKCE and authenticate at the token endpoint with the client secret.

Never put a client secret in browser or mobile application code. Register exact redirect URIs, and create new state, nonce, and PKCE values for every authentication request.

Validate the ID token

Use a maintained OpenID Connect library to validate ID tokens. Do not only decode the JWT. The validation must:

Verify the signature with a key from the discovery document's jwks_uri.
Accept only the advertised signing algorithm.
Confirm that iss exactly matches the expected issuer.
Confirm that aud contains your client ID.
Confirm that exp has not passed and that the token time claims are valid.
Compare nonce with the value stored for the login transaction.
Require sub and use it as the customer's pairwise identifier for this client.

Only create the customer session after all checks succeed.

Discovery

Use the issuer URL shown in Studio to load the OpenID Connect discovery document:

{issuer}/.well-known/openid-configuration

The document contains the authorization, token, UserInfo, intent, and JSON Web Key endpoints. It also describes the supported protocol features. Confirm that the returned issuer exactly matches the issuer URL you expected.

Scopes

Every authentication request must include openid and at least one additional scope configured for the authentication in Studio. The available scopes depend on the selected digital identity wallets and configuration. Only request the information your platform needs.

Supported protocol

Feature	Supported value
Response type	`code`
Grant type	`authorization_code`
PKCE method	`S256`
ID token signing algorithm	`ES384`
Subject type	`pairwise`
Client types	Public and confidential

Specifications

OpenID Connect Core 1.0
OpenID Connect Discovery 1.0
Proof Key for Code Exchange, RFC 7636
OAuth 2.0 Authorization Server Metadata, RFC 8414
OAuth 2.0 Security Best Current Practice, RFC 9700
OAuth 2.1 current draft, which remains a work in progress

On this page