Online Authentication Rest API 

The Digital Credential Platform exposes the following OpenID Connect endpoints to a Relying Party:

  1. OpenID Connect Discovery
    /.well-known/openid-configuration
    /.well-known/oauth-authorization-server
    Used to retrieve OpenID Connect configuration and metadata. Both endpoints provide authorization server metadata. OpenID Connect clients should typically use /.well-known/openid-configuration.

  2. OpenID Connect Authorization Endpoint
    /authorize
    Used to initiate browser-based Online Authentication through the OpenID Connect Authorization Code Flow.

  3. OpenID Connect CIBA Endpoint
    /bc-authorize
    Used to initiate backchannel authentication through the CIBA flow.

  4. OpenID Connect Token Endpoint
    /token
    Used to retrieve tokens (access tokens, ID tokens, and refresh tokens) after successful authentication or transaction confirmation.

Digital Credential Platform specific extension 

The Authorization Endpoint (/authorize) includes two additional optional request parameters that extend the standard OpenID Connect Authorization Request:

  • rp_name - display name of the Relying Party, shown to the user during authentication.

  • rp_client_logo_url - URL of the Relying Party logo displayed during authentication and in the mobile application.

    The logo can be provided either as an SVG image referenced by a URL ending with the .svg file extension or as a JPEG image.

    For SVG images, the .svg file extension is mandatory. If the extension is missing, the application treats the logo as a raster image (JPEG).

    If no logo is provided, or if the logo cannot be processed due to an unsupported or incorrect file format, the mobile application displays a placeholder generated from the first two characters of the Relying Party name.

    For the best visual appearance, the logo should be square and at least 141 × 141 pixels. Larger images are automatically scaled to fit the available space while preserving their aspect ratio.

IMPORTANT
The Digital Credential Platform does not support the OpenID Connect endpoints:

  • /end_session
  • /userinfo

The /end_session endpoint, typically available in OpenID Connect Identity Providers, is not available in the Digital Credential Platform because SSO session management is not supported. This is aligned with the Identity on the Edge approach, where personal data and identity claims are not stored on the server side.

The /userinfo endpoint is not supported because, with the Identity on the Edge approach, personal data and identity claims are not stored on the server side.

Relying Parties should not rely on /userinfo to retrieve user attributes. Approved identity attributes are returned as part of the configured OpenID Connect token response, according to the selected flow, requested scopes, and issuer settings.

Know where is user during online authentication process

Janssen Authorization Server is an OAuth 2.0 Authorization Server and OpenID Connect Provider (OP).

It provides standards-based authentication and authorization services, including OpenID Connect Discovery, OAuth 2.0 Authorization Server Metadata, Authorization, Token, Introspection, UserInfo, Session Management, and CIBA endpoints.

This deployment includes Digital Credential Platform-specific customizations and exposes only the subset of functionality required for online authentication and credential-based flows.

In order to make use of the API, please log in

Download dc-authenticate\jans-auth.json