Start an authentication

Use the Ver.iD SDK to create the authorization request, keep the PKCE verifier, finalize the callback, and verify the ID token. Any OpenID Connect client library works as well; How it works lists the validation rules it must apply.

Copy the issuer URI and client identifier from the active authentication's Configuration tab. The redirect URI must be registered on the authentication, and the scope must include openid and at least one wallet scope.

Browser applicationCopy Anchor Link

Use the browser client for a public client. It uses PKCE and needs no client secret.

yarn add @ver-id/browser-client

import { VeridAuthenticationClient } from '@ver-id/browser-client';

const authenticationClient = new VeridAuthenticationClient({
  issuerUri: '<ISSUER_URI>',
  client_id: '<AUTHENTICATION_CLIENT_ID>',
  redirectUri: 'https://example.com/authentication/callback',
});

const { authenticationUrl } =
  await authenticationClient.generateAuthenticationUrl({
    scope: 'openid email',
  });

window.location.assign(authenticationUrl);

On the registered callback page, create the same client and finalize the flow:

const authenticationResponse = await authenticationClient.finalize();
const idToken = await authenticationClient.decode(authenticationResponse);

decode verifies the ID token before returning its header and payload. Create the customer session only after it succeeds, and use the sub claim as the customer's pairwise identifier for this client.

Server applicationCopy Anchor Link

Use the Node.js client for a confidential client. It exchanges the authorization code with the client secret on your server, so the secret never reaches the browser.

yarn add @ver-id/node-client

import { VeridAuthenticationClient } from '@ver-id/node-client';

const authenticationClient = new VeridAuthenticationClient({
  issuerUri: '<ISSUER_URI>',
  client_id: '<AUTHENTICATION_CLIENT_ID>',
  redirectUri: 'https://example.com/authentication/callback',
});

const { authenticationUrl, state } =
  await authenticationClient.generateAuthenticationUrl({
    scope: 'openid email',
  });

Redirect the customer to the authentication URL. When Ver.iD redirects them back, finalize with the complete callback URL and the attached OAuth client secret:

const authenticationResponse = await authenticationClient.finalize({
  clientAuth: { client_secret: process.env.VERID_CLIENT_SECRET },
  callbackParams: callbackUrl,
});
const idToken = await authenticationClient.decode(authenticationResponse);

Identity provider brokeringCopy Anchor Link

If your applications already sign in through an identity provider, configure Ver.iD as an OpenID Connect provider there instead of calling it from each application. The Keycloak integration is a tested example.

See the @ver-id/browser-client and @ver-id/node-client authentication guides for cache options, custom state, and response types.