Idura

https://docs.idura.app
Admin
Idura is a digital identity and eSignature platform providing eID authentication and document...
Tokens:164,217
Snippets:1,254
Trust Score:4.6
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install @criipto/verify-react

Source: https://docs.idura.app/verify/integrations/react

Install the React SDK via npm.

```bash
npm install @criipto/verify-react
```

--------------------------------

### Install @criipto/auth-js via npm

Source: https://docs.idura.app/verify/integrations/javascript

Install the @criipto/auth-js package using npm.

```bash
npm install --save @criipto/auth-js
```

--------------------------------

### Install criipto-signatures SDK

Source: https://docs.idura.app/signatures/integrations/python

Install the criipto-signatures SDK from PYPI using either pip or uv. The SDK supports Python 3.13 and later.

```bash
python3 -m pip install criipto-signatures
uv add criipto-signatures
```

--------------------------------

### Install @criipto/verify-express with npm

Source: https://docs.idura.app/verify/integrations/nodejs-express

Install the @criipto/verify-express package using npm.

```bash
npm install @criipto/verify-express
```

--------------------------------

### Install Microsoft.AspNetCore.Authentication.OpenIdConnect

Source: https://docs.idura.app/verify/integrations/aspnet-core-v6

Installs the OpenID Connect authentication handler package for ASP.NET Core. The Cookie handler is usually already included.

```bash
dotnet add package Microsoft.AspNetCore.Authentication.OpenIdConnect
```

--------------------------------

### Install @criipto/signatures SDK

Source: https://docs.idura.app/signatures/integrations/nodejs

Install the @criipto/signatures SDK using either npm or yarn. The SDK is available on npm and supports Node 16 and later.

```bash
npm install --save @criipto/signatures
```

```bash
yarn add @criipto/signatures
```

--------------------------------

### Install Criipto.Signatures via Package Manager Console and dotnet CLI

Source: https://docs.idura.app/signatures/integrations/csharp

Install the SDK using either the Package Manager Console or the dotnet CLI. The library supports netstandard2.0 including .NET 8 and .NET 10.

```bash
Install-Package Criipto.Signatures
```

```bash
dotnet add package Criipto.Signatures
```

--------------------------------

### Install openid-connect-php via Composer

Source: https://docs.idura.app/verify/integrations/php

Install the OpenID Connect PHP library using Composer. Requires PHP 5.4 or greater, and the CURL, JSON, and XML extensions.

```bash
composer require jumbojett/openid-connect-php
```

--------------------------------

### Token response example

Source: https://docs.idura.app/verify/reference/authorization-flows/ciba

Example JSON response from the token endpoint after successful user identification. Contains token_type, expires_in, id_token, and access_token.

```json
{
  "token_type": "Bearer",
  "expires_in": 120,
  "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjgyN0Q5QTNFOTg2MTY0OTVBQzZGRTE3MUFFNkRBM0IzQ0ExNDE5MjEifQ.eyJpc3MiOiJodHRwczovL25hdGFsaWEtZGV2LXRlc3QuY3JpcHRvLmlvIiwiYXVkIjoidXJuOmNpYmEiLCJpZGVudGl0eXNjaGVtZSI6InNlYmFua2lkIiwiYXV0aGVudGljYXRpb250eXBlIjoidXJuOmdybjphdXRoOnNlOmJhbmtpZCIsImF1dGhlbnRpY2F0aW9ubWV0aG9kIjoidXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6U29mdHdhcmVQS0kiLCJhdXRoZW50aWNhdGlvbmluc3RhbnQiOiIyMDI0LTA1LTIyVDEwOjQxOjQxLjM2MVoiLCJuYW1laWRlbnRpZmllciI6ImJiOWMyMzY0ZGZhZTQ0ZjNiY2ZkOTk5MDUzZDk0ZjllIiwic3ViIjoie2JiOWMyMzY0LWRmYWUtNDRmMy1iY2ZkLTk5OTA1M2Q5NGY5ZX0iLCJzZXNzaW9uaW5kZXgiOiJiNjVmMTFiNi1lYmE3LTQ4ODItOTAwYS01ZjJkOTNhMzhkYmEiLCJzc24iOiIxOTY4MDIwMjA1NzUiLCJuYW1lIjoiVGVybmUgUGF1bHNlbiIsImdpdmVubmFtZSI6IlRlcm5lIiwiZ2l2ZW5fbmFtZSI6IlRlcm5lIiwic3VybmFtZSI6IlBhdWxzZW4iLCJmYW1pbHlfbmFtZSI6IlBhdWxzZW4iLCJpcGFkZHJlc3MiOiIxODUuMTU3LjEzNC4xMzQiLCJjb3VudHJ5IjoiU0UiLCJpYXQiOjE3MTYzNzQ1MDEsIm5iZiI6MTcxNjM3NDUwMSwiZXhwIjoxNzE2Mzc1NzAxfQ.RVQnlukfoH597uXzE1Gays5DElGzAr8xgOmi7ZWppaL3QPGhV4vK2o6qLhxXg_-FKG9xCwHR6gEhnNzWA3W3B6Q2zJeQTYh9okUvTmmhAFIyDL7lEtfWVVKUKvauDisYVZDjAxJQS_1zbgPEi5I-UJ6_kvMGH-wC13MAD2bZGTGR2dR-ZevBUn7plOt0PKXrIZD3vwxDfebTMPQqX_9SNT5F7GLjCcpeVK-T5LOgmUMFcTAbHvNyklqP5ymRHsZLDw_ib4I7ZqODhR-3uISWo1NvG4Y84iBcqv50WRNlmMUm004LfPw1flM5DNsVyUWCqYW8m7eBEwLp5va-6OQG4w",
  "access_token": "cf1ce646-7fbe-4740-9c56-fe3f0891f6c6"
}
```

--------------------------------

### post-auth-resume event example

Source: https://docs.idura.app/verify/extensions/webhook-post-auth

Example JSON payload for a post-auth-resume event. Contains event type, conversationId, environment, and resumeRequest with a url. Use conversationId to persist state between events.

```json
{
  "event": "post-auth-resume-event-1.0",
  "conversationId": "e926e5da4c8d428e8c4f36d88060459e",
  "environment": "test",
  "resumeRequest": {
    "url": "..."
  }
}
```

--------------------------------

### Install @criipto/verify-expo and expo-build-properties

Source: https://docs.idura.app/verify/integrations/react-native-expo

Install the Idura Verify Expo module and the expo-build-properties plugin, which is required to set the Android minSdkVersion and iOS deployment target and dynamic framework linkage.

```bash
npm install @criipto/verify-expo expo-build-properties
```

--------------------------------

### Query example

Source: https://docs.idura.app/signatures/webhooks/events

Example GraphQL query to retrieve signatory status and signature order ID.

```APIDOC
## Query example

### Description
Example GraphQL query to retrieve signatory status and signature order ID.

### Query
```graphql
query SignatoryWebhook($signatoryId: ID!) {
  signatory(id: $signatoryId) {
    status
    signatureOrder {
      id
    }
  }
}
```
```

--------------------------------

### Raw HTTP GET request to /oauth2/authorize

Source: https://docs.idura.app/verify/reference/request-parameters

Example of a raw HTTP GET request to the Idura Verify authorization endpoint. Line breaks are added for readability. If using PAR, the parameters are sent via HTTP POST instead.

```http
  GET /oauth2/authorize?
    client_id=urn:my:app:id&
    redirect_uri=https://my-app.com/callback&
    response_type=code&
    scope=openid&
    acr_values=urn:grn:authn:no:bankid&
    state=8a7b6c5d4e3f2g1h HTTP/1.1
  Host: acme-corp.idura.broker
```

--------------------------------

### post-auth event example

Source: https://docs.idura.app/verify/extensions/webhook-post-auth

Example JSON payload for a post-auth event. Contains event type, conversationId, environment, user object with sub and eID-specific properties, and resumeUrl for redirecting the user.

```json
{
  "event": "post-auth-event-1.0",
  "conversationId": "e926e5da4c8d428e8c4f36d88060459e",
  "environment": "test",
  "user": {
    "identityscheme": "sebankid",
    "sub": "{ba8568cb-e9f4-4d1c-a9a5-814462641bdc}",
    "...": "eID specific"
  },
  "resumeUrl": "https://extensions.criipto.com/extension/resumePostAuth?..."
}
```

--------------------------------

### Configure IDURA_CLIENT_ID and IDURA_DOMAIN in config file

Source: https://docs.idura.app/verify/integrations/swift

Add these keys to your config file (e.g., .xcconfig) to store your Idura domain and client ID. The example values are placeholders.

```text
IDURA_CLIENT_ID = this-is-an-example.idura.broker
IDURA_DOMAIN = urn:my:application:identifier:XXXX
```

--------------------------------

### Authorize URL Builder Example

Source: https://docs.idura.app/verify/guides/age-verification

Example authorization URL for age verification using the Idura broker. It includes the required parameters such as scope, client_id, redirect_uri, response_type, response_mode, nonce, acr_values, and login_hint.

```text
https://docs-samples.test.idura.broker/oauth2/authorize?
	scope=openid is_over_18&
	client_id=urn:idura:dev&
	redirect_uri=https://jwt.io&
	response_type=id_token&
	response_mode=fragment&
	nonce=ecnon-deeb67bd-3dd2-4255-a442-3d4483a4ed99&
	acr_values=urn:age-verification&
	login_hint=country:DK
```

--------------------------------

### Example body class attributes for Idura Verify

Source: https://docs.idura.app/verify/guides/custom-styling

Example of the CSS classes attached to the body element when using SE BankID authentication on the DNS name identity.yourdomain.com with a custom CSS class name of app-one.

```html
<body class="sebankid broker auth host-identity-yourdomain-com app-one" />
```

--------------------------------

### Full i18n tag attributes example

Source: https://docs.idura.app/verify/guides/custom-styling

Full example of possible attributes for the <i18n> tag. It supports da, en, sv, se, fi, nb, and a default parameter for fallback when no language is matched.

```html
<i18n
  da="[danish text]"
  en="[english text]"
  sv="[swedish text]"
  se="[swedish text]"
  fi="[finnish text]"
  nb="[norwegian text]"
  default="[fallback text]"
/>
```

--------------------------------

### Configure the SDK

Source: https://docs.idura.app/signatures/integrations/nodejs

Configure the SDK by creating a new CriiptoSignatures client with your Idura client ID and client secret. This is the initial setup required for all subsequent API calls.

```javascript
import CriiptoSignatures from '@criipto/signatures';
const client = new CriiptoSignatures('{YOUR_IDURA_CLIENT_ID}', '{YOUR_IDURA_CLIENT_SECRET}');
```

--------------------------------

### Callback URL for local development

Source: https://docs.idura.app/verify/integrations/javascript

Example callback URL for a locally running plain HTML application. Register this URL in the Callback URLs field of your Idura Verify application settings.

```text
http://localhost:3000/example/index.html
```

--------------------------------

### Authorize Request with login_hint

Source: https://docs.idura.app/verify/e-ids/vipps-mobilepay

Example of an OAuth2 authorize request using the login_hint parameter to request scopes when the scope parameter cannot be controlled.

```APIDOC
## GET /oauth2/authorize

### Description
Initiates the OAuth2 authorization flow with Vipps MobilePay, requesting specific user claims via the `login_hint` parameter.

### Method
GET

### Endpoint
`https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize`

### Parameters
#### Query Parameters
- **login_hint** (string) - Required - Space-separated list of scope hints. Example: `scope:phone scope:ssn`.

### Request Example
```
https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?...&login_hint=scope:phone scope:ssn&...
```

### Response
#### Success Response (302)
Redirects to the authorization server with the authorization code.

#### Response Example
No response body; the user is redirected.
```

--------------------------------

### Include Composer autoloader

Source: https://docs.idura.app/verify/integrations/php

Include the Composer autoloader to load the installed library.

```php
require __DIR__ . '/vendor/autoload.php';
```

--------------------------------

### Authorize request with scopes

Source: https://docs.idura.app/verify/e-ids/vipps-mobilepay

Example authorize request URL that requests the 'phone' and 'ssn' scopes. The 'scope' parameter is used to request additional data.

```http
https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?scope=openid phone ssn&...
```

--------------------------------

### Example of nested address claim before flattening

Source: https://docs.idura.app/verify/extensions/ciam-interop

Shows the OpenID standard address claim as a nested object. Used to illustrate the input to the unnesting_namespace option.

```json
{
  "address": {
    "street_address": "value"
  }
}
```

--------------------------------

### Authorization with popup

Source: https://docs.idura.app/verify/integrations/javascript

Opens a popup window to authenticate the user using criiptoAuth.popup.authorize. The example includes a login button and displays the result in a div. The redirectUri must be whitelisted in the application settings.

```html
<!-- index.html -->
...
<button id="login-button-popup">Login</button>
<div id="result"></div>
...

<script type="text/javascript">
  document.getElementById('login-button-popup').addEventListener('click', () => {
    criiptoAuth.popup
      .authorize({
        width: 300,
        height: 400,
        redirectUri: 'http://localhost:8000/example/index.html',
        acrValues: '{{ACR_VALUES || urn:grn:authn:dk:mitid:substantial}}',
      })
      .then(result => {
        console.log(result, result.id_token, result.claims);
        document.getElementById('result').textContent = JSON.stringify(result);
      });
  });
</script>
```

--------------------------------

### Authenticate and get verified claims with OpenIDConnectClient

Source: https://docs.idura.app/verify/integrations/php

Initialize the OpenIDConnectClient with your Idura domain, client ID, and client secret, then authenticate and retrieve a verified claim (e.g., 'name'). Replace the placeholders with your actual values.

```php
require __DIR__ . '/vendor/autoload.php';
use Jumbojett\OpenIDConnectClient;

$oidc = new OpenIDConnectClient('https://{{YOUR_IDURA_DOMAIN}}',
                                '{{YOUR_CLIENT_ID}}',
                                '{{YOUR_CLIENT_SECRET}}');

$oidc->authenticate();
// Or any other available claim based on your used authentication method: https://docs.idura.app/verify/e-ids/
$name = $oidc->getVerifiedClaims('name');
```

--------------------------------

### Pending Response with authorization_pending Error

Source: https://docs.idura.app/verify/reference/authorization-flows/headless

Example response while authentication is pending. The server returns HTTP 400 with an authorization_pending error and an error_description indicating that the first user interaction is awaited.

```http
HTTP/1.1 400 Bad Request
Content-Type: application/json
{
  "error": "authorization_pending",
  "error_description": "awaiting first user interaction",
  "acr_data": {... e-ID specific metadata ...}
}
```

--------------------------------

### HTTP POST request to /ciba/bc-authorize

Source: https://docs.idura.app/verify/guides/caller-authentication

Starts a CIBA authentication request. Replace YOUR_DOMAIN.idura.broker, $client_assertion, and SSN with actual values. If using client secret authentication, use HTTP Basic Authorization instead of client_assertion. The login_hint may differ per eID (e.g., sub:phone:PHONE for Vipps/MobilePay).

```http
# Replace `YOUR_DOMAIN.idura.broker` with your Idura domain
# Replace `$client_assertion` with your JWT assertion
# Replace `SSN` with a valid SSN
# Note: If you authenticate with a client secret, use HTTP Basic Authorization (Authorization: Basic base64(client_id:client_secret)).

HTTP POST https://YOUR_DOMAIN.idura.broker/ciba/bc-authorize
Content-Type: application/x-www-form-urlencoded

scope=openid
&login_hint=sub:ssn:SSN
&acr_values=ACR_VALUE
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&client_assertion=$client_assertion
&authorization_details=... # Add eID-specific parameters here
```

--------------------------------

### GET /oauth2/authorize

Source: https://docs.idura.app/verify/guides/authorize-url-builder?acr_values=urn%3Agrn%3Aauthn%3Ase%3Afrejaid&frejaAction=sign_extended&message=Test+extended+signature+flow&nonVisibleData=TEST_BINARY_DATA&title=Extended+signature

Example of an OAuth2 authorization request using FrejaID with extended signature flow, including parameters for title, message, and non-visible data.

```APIDOC
## GET /oauth2/authorize

### Description
Initiates an OAuth2 authorization request with FrejaID eID, extended signature flow, and additional parameters.

### Method
GET

### Endpoint
/oauth2/authorize

### Parameters
#### Query Parameters
- **scope** (string) - Required - OAuth2 scope, must include `openid`.
- **client_id** (string) - Required - Client identifier, e.g., `urn:idura:dev`.
- **redirect_uri** (string) - Required - URI to redirect after authentication, e.g., `https://jwt.io`.
- **response_type** (string) - Required - Response type, e.g., `id_token`.
- **response_mode** (string) - Required - Response mode, e.g., `fragment`.
- **nonce** (string) - Required - Nonce value for replay protection.
- **acr_values** (string) - Required - Authentication context class reference, e.g., `urn:grn:authn:se:frejaid`.
- **login_hint** (string) - Required - Encoded parameters for the signature flow, including `action`, `title`, `message`, and `nonVisibleData`.

### Request Example
```
https://docs-samples.test.idura.broker/oauth2/authorize?
	scope=openid&
	client_id=urn:idura:dev&
	redirect_uri=https://jwt.io&
	response_type=id_token&
	response_mode=fragment&
	nonce=ecnon-9e4cc4d5-d96f-4b89-9789-9a922c35d40b&
	acr_values=urn:grn:authn:se:frejaid&
	login_hint=action:sign_extended title:RXh0ZW5kZWQgc2lnbmF0dXJl message:VGVzdCBleHRlbmRlZCBzaWduYXR1cmUgZmxvdw== nonVisibleData:VEVTVF9CSU5BUllfREFUQQ==
```

### Response
#### Success Response (200)
Redirects to the specified `redirect_uri` with the authentication result.

#### Response Example
No explicit response example provided in the source.
```

--------------------------------

### GET /oauth2/authorize

Source: https://docs.idura.app/verify/guides/authorize-url-builder?acr_values=urn%3Agrn%3Aauthn%3Ase%3Afrejaid&frejaAction=sign&message=Test+simple+signature+flow&title=Simple+signature

This snippet documents the OAuth2 authorization endpoint used to initiate a Freja eID signature flow. It shows the required query parameters and an example request URL.

```APIDOC
## [GET] /oauth2/authorize

### Description
Initiates an OAuth2 authorization request to start a Freja eID signature flow. The request includes the `acr_values` parameter set to `urn:grn:authn:se:frejaid` and uses `login_hint` to pass the signature action, title, and message.

### Method
GET

### Endpoint
/oauth2/authorize

### Parameters
#### Query Parameters
- **scope** (string) - Required - Must include `openid`.
- **client_id** (string) - Required - The client identifier, e.g., `urn:idura:dev`.
- **redirect_uri** (string) - Required - The URI to redirect to after authentication, e.g., `https://jwt.io`.
- **response_type** (string) - Required - Must be `id_token`.
- **response_mode** (string) - Required - Must be `fragment`.
- **nonce** (string) - Required - A unique nonce value.
- **acr_values** (string) - Required - The authentication context class reference, e.g., `urn:grn:authn:se:frejaid`.
- **login_hint** (string) - Required - A base64-encoded string containing the signature action, title, and message. Format: `action:sign title:<base64> message:<base64>`.

### Request Example
```
https://docs-samples.test.idura.broker/oauth2/authorize?
	scope=openid&
	client_id=urn:idura:dev&
	redirect_uri=https://jwt.io&
	response_type=id_token&
	response_mode=fragment&
	nonce=ecnon-5f56ec45-f7c2-4cbd-99cf-f88b7dc31f52&
	acr_values=urn:grn:authn:se:frejaid&
	login_hint=action:sign title:U2ltcGxlIHNpZ25hdHVyZQ== message:VGVzdCBzaW1wbGUgc2lnbmF0dXJlIGZsb3c=
```

### Response
#### Success Response (200)
No response body is documented. The response is expected to be a redirect to the `redirect_uri` with the `id_token` in the fragment.

```

--------------------------------

### Initialize SDK from unpkg

Source: https://docs.idura.app/verify/integrations/javascript

Initialize the CriiptoAuth SDK when using the library from unpkg, accessing the global variable CriiptoAuth. The constructor requires domain and clientID, and can accept additional authorization parameters.

```javascript
// index.js

var criiptoAuth = new CriiptoAuth({
  domain: '{{YOUR_IDURA_DOMAIN}}',
  clientID: '{{YOUR_CLIENT_ID}}',
  store: sessionStorage,
});
```

--------------------------------

### Initialize SDK with npm import

Source: https://docs.idura.app/verify/integrations/javascript

Initialize the CriiptoAuth SDK when using npm, importing the library from '@criipto/auth-js'. The constructor requires domain and clientID, and can accept additional authorization parameters.

```javascript
// index.js

import CriiptoAuth from '@criipto/auth-js';

var criiptoAuth = new CriiptoAuth({
  domain: '{{YOUR_IDURA_DOMAIN}}',
  clientID: '{{YOUR_CLIENT_ID}}',
  store: sessionStorage,
});
```

--------------------------------

### GET https://signatures.idura.app/v1/graphql

Source: https://docs.idura.app/signatures/graphql/endpoints

Fetches the GraphQL schema for build/codegen tools. Executing a GET request against the GraphQL endpoint returns the schema.

```APIDOC
## GET https://signatures.idura.app/v1/graphql

### Description
Fetches the GraphQL schema for build/codegen tools. Executing a GET request against the GraphQL endpoint returns the schema.

### Method
GET

### Endpoint
https://signatures.idura.app/v1/graphql

### Request Example
```
curl https://signatures.idura.app/v1/graphql
```

### Response
#### Success Response (200)
- **schema** (object) - The GraphQL schema definition.

#### Response Example
```
{
  "data": { ... }
}
```
```

--------------------------------

### Configure OpenID Connect Middleware with appsettings.json and Program.cs

Source: https://docs.idura.app/verify/integrations/aspnet-core-v6

Configures the OpenID Connect middleware in an ASP.NET Core application. The appsettings.json file supplies the Idura domain, client ID, and client secret. The Program.cs code sets up cookie policy, adds authentication with cookie and OIDC handlers, and configures the OIDC options including the authority, response type, and callback paths. The callback paths must match the Callback URLs configured in Idura Verify.

```json
// appsettings.json
{
  "Idura": {
    "Domain": "{{YOUR_IDURA_DOMAIN}}",
    "ClientId": "{{YOUR_CLIENT_ID}}",
    "ClientSecret": "YOUR_CLIENT_SECRET"
  }
}
```

```csharp
// Program.cs

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    // This lambda determines whether user consent for non-essential cookies is needed for a given request.
    options.CheckConsentNeeded = context => true;
    options.MinimumSameSitePolicy = SameSiteMode.None;
});

builder.Services.AddAuthentication(options => {
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect(options => {
    options.ClientId = builder.Configuration["Idura:ClientId"];
    options.ClientSecret = builder.Configuration["Idura:ClientSecret"];
    options.Authority = $"https://{builder.Configuration["Idura:Domain"]}/";
    options.ResponseType = "code";

    // The next to settings must match the Callback URLs in Idura Verify
    options.CallbackPath = new PathString("/callback");
    options.SignedOutCallbackPath = new PathString("/signout");
});
```

--------------------------------

### Example Bearer Token Format

Source: https://docs.idura.app/verify/extensions/webhook-post-auth

Example JWT token format included in the Authorization header. Contains jti, iss, sub, and aud claims.

```json
{
  "jti": "90fb519d-6d64-4646-a02c-39b4833d61b2",
  "iss": "https://extensions.criipto.com/service",
  "sub": "e1369c3702d344e38e2cbc3fcb947e01",
  "aud": "ext_test_webhook_postauth_03028258"
}
```

--------------------------------

### Initialize SDK with CriiptoVerifyProvider

Source: https://docs.idura.app/verify/integrations/react

Wrap your React app in CriiptoVerifyProvider, passing your Idura domain, client ID, and redirect URI. The redirectUri must be registered as a redirect URL on your Idura application.

```jsx
// src/index.js
import React from 'react';
import ReactDOM from 'react-dom';
import { CriiptoVerifyProvider } from '@criipto/verify-react';

import App from './App';

ReactDOM.render(
  <CriiptoVerifyProvider
    domain="{YOUR_IDURA_DOMAIN}"
    clientID="{YOUR_IDURA_APPLICATION_CLIENT_ID}"
    redirectUri={window.location.href}
  >
    <App />
  </CriiptoVerifyProvider>,
  document.getElementById('root'),
);
```

--------------------------------

### Create signature order with CriiptoSignaturesClient

Source: https://docs.idura.app/signatures/integrations/csharp

Creates a signature order with a PDF document. Reads a PDF file, sets up document input with PadesDocumentInput, and creates the order. The signatureOrder.id should be stored for later steps.

```csharp
using Criipto.Signatures;
using Criipto.Signatures.Models;

using (var client = new CriiptoSignaturesClient("{YOUR_IDURA_CLIENT_ID}", "{YOUR_IDURA_CLIENT_SECRET}")) {
    var pdfFile = File.ReadAllBytes("...some pdf file");

    // Setup document input
    var documents = new List<DocumentInput>{
        new DocumentInput {
            pdf = new PadesDocumentInput {
                title = "Dotnet Sample",
                blob = pdfFile,
                storageMode = DocumentStorageMode.Temporary
            }
        }
    };

    // Setup signature order input
    var createSignatureOrderInput = new CreateSignatureOrderInput
    {
        title = "Dotnet Sample",
        documents = documents
    };

    // Create signature order
    var signatureOrder = await client.CreateSignatureOrder(createSignatureOrderInput);

    // ... store the signatureOrder.id
}
```

--------------------------------

### CriiptoAuth Constructor

Source: https://docs.idura.app/verify/integrations/javascript

Initializes the CriiptoAuth SDK with your application details.

```APIDOC
## CriiptoAuth Constructor

### Description
Initializes the CriiptoAuth SDK with your application details.

### Method
Constructor

### Parameters
- **domain** (string) - Required - The domain your Idura Application belongs to, such as `example.idura.broker`.
- **clientID** (string) - Required - The Client ID for your Idura Application.
- **store** (object) - Optional - Storage mechanism (e.g., `sessionStorage`).

### Example
```javascript
var criiptoAuth = new CriiptoAuth({
  domain: '{{YOUR_IDURA_DOMAIN}}',
  clientID: '{{YOUR_CLIENT_ID}}',
  store: sessionStorage,
});
```
```

--------------------------------

### Load @criipto/auth-js from unpkg

Source: https://docs.idura.app/verify/integrations/javascript

Include the @criipto/auth-js library directly in your HTML file by loading it from unpkg. Place this in your index.html file.

```html
<!-- index.html -->

<script type="text/javascript" src="https://unpkg.com/@criipto/auth-js@^3.8"></script>
```

--------------------------------

### BrowserManager.present(url:)

Source: https://docs.idura.app/verify/integrations/swift

Presents the authorization URL and returns the callback URL.

```APIDOC
## [SDK] BrowserManager.present(url:)

### Description
Presents the authorization URL in the browser and returns the callback URL.

### Method
present(url:)

### Parameters
- **url** (URL) - Required - The authorization URL returned by your backend after initializing the flow.

### Return Value
- **callbackUrl** (URL) - Contains the OIDC response (code, state, or error).

### Example
```swift
let callbackUrl = try await browser.present(url: authorizeUrl)
```
```

--------------------------------

### Initialize CriiptoAuth with application details

Source: https://docs.idura.app/verify/integrations/vuejs

Initialize the CriiptoAuth SDK with your Idura domain and client ID. The store parameter is set to sessionStorage. Replace the placeholders with your actual values.

```javascript
// App.vue

import CriiptoAuth from '@criipto/auth-js';

var criiptoAuth = new CriiptoAuth({
  domain: '{{YOUR_IDURA_DOMAIN}}',
  clientID: '{{YOUR_CLIENT_ID}}',
  store: sessionStorage,
});
```

--------------------------------

### Token example

Source: https://docs.idura.app/verify/e-ids/vipps-mobilepay

Example token claims returned after Vipps MobilePay authentication. Shows standard OIDC claims (name, family_name, given_name, address, birthdate, gender) and custom claims (identityscheme, nameidentifier, sub, emailaddress, mobilephone, socialno).

```json
{
  "identityscheme": "novippslogin",
  "nameidentifier": "75dca5991ad74a0981c092d424b82fbc",
  "sub": "{75dca599-1ad7-4a09-81c0-92d424b82fbc}",
  "address": {
    "street_address": "BOKS 6300, ETTERSTAD",
    "postal_code": "0603",
    "region": "OSLO",
    "country": "NO",
    "formatted": "BOKS 6300, ETTERSTAD\n0603\nOSLO\nNO"
  },
  "birthdate": "1955-09-82",
  "gender": "male",
  "emailaddress": "mikkel@idura.com",
  "mobilephone": "4748059940",
  "socialno": "10098235846",
  "family_name": "Larsen",
  "given_name": "Mikkel",
  "name": "Mikkel Larsen",
  "country": "NO"
}
```

--------------------------------

### Build Authorization header for token exchange

Source: https://docs.idura.app/verify/reference/authorization-flows/authorization-code-flow

Construct the Authorization header value for the token exchange in PHP, Node.js, JavaScript, and C#. Each example URL-encodes the client ID and secret before base64-encoding them. The C# example includes an alternative using AntiXssEncoder when System.Web.dll is available.

```PHP
# PHP
"Authorization" => "Basic ".base64_encode(urlencode(IDURA_CLIENT_ID).":".urlencode(IDURA_SECRET))
```

```JavaScript
// Node.js
'Authorization': "Basic " + Buffer.from(`${encodeURIComponent(IDURA_CLIENT_ID)}:${encodeURIComponent(IDURA_SECRET)}`).toString('base64')

// Javascript
'Authorization': "Basic " + btoa(`${encodeURIComponent(IDURA_CLIENT_ID)}:${encodeURIComponent(IDURA_SECRET)}`)
```

```C#
// C#
using System;
using System.Text;
"Basic " + Convert.ToBase64String(Encoding.ASCII.GetBytes(Uri.EscapeDataString(IDURA_CLIENT_ID) + ":" + Uri.EscapeDataString(IDURA_SECRET)))

// C# - if you have a dependency on System.Web.dll or you are willing to take it
using System;
using System.Text;
using System.Web.Security.AntiXss;
"Basic " + Convert.ToBase64String(Encoding.ASCII.GetBytes(AntiXssEncoder.UrlEncode(IDURA_CLIENT_ID) + ":" + AntiXssEncoder.UrlEncode(IDURA_SECRET)))
```

--------------------------------

### Present browser yourself with BrowserManager

Source: https://docs.idura.app/verify/integrations/swift

Shows how to use the exposed BrowserManager class to open the browser and receive the callback URL when the authorization request is initialized by your own backend. The redirectUri must be an https URL on an Associated Domain, otherwise the initializer throws BrowserManagerError.configurationError.

```swift
let browser = try BrowserManager(
  redirectUri: URL(string: "https://your-domain.idura.broker/ios/callback")!,
  useEphemeralBrowserSession: true
)

// `authorizeUrl` is the authorization URL your backend returned after initializing the flow.
let callbackUrl = try await browser.present(url: authorizeUrl)

// `callbackUrl` contains the OIDC response (code, state, or error). Send it to your backend
// to complete the code exchange.
```

--------------------------------

### GET /.well-known/openid-configuration

Source: https://docs.idura.app/verify/guides/work-with-metadata

Retrieves OpenID Connect discovery metadata for the identity broker.

```APIDOC
## GET /.well-known/openid-configuration

### Description
Retrieves OpenID Connect discovery metadata for the identity broker.

### Method
GET

### Endpoint
https://yourdomain.idura.broker/.well-known/openid-configuration

### Response
#### Success Response (200)
- **configuration** (JSON) - OpenID Connect discovery document

#### Response Example
{
  "issuer": "https://yourdomain.idura.broker",
  "authorization_endpoint": "...",
  "token_endpoint": "..."
}
```

--------------------------------

### Instantiate IduraVerify SDK

Source: https://docs.idura.app/verify/integrations/kotlin

Instantiate the IduraVerify SDK with the client ID, domain, and the activity that hosts your login UI. The instance is tied to that activity and stops working once the activity is destroyed.

```kotlin
val iduraVerify =
  IduraVerify(
    BuildConfig.IDURA_CLIENT_ID,
    BuildConfig.IDURA_DOMAIN,
    activity = activity,
  )
```

--------------------------------

### Initialize IduraVerify with domain

Source: https://docs.idura.app/verify/integrations/swift

Initializes the IduraVerify SDK with a domain. The `try!` is deliberate: a malformed domain is a build-configuration mistake, so it fails on your own first run rather than in production. Construct the instance further up the view hierarchy if you would rather handle the error.

```swift
var body: some View { /* ... */ }
```

--------------------------------

### GET /oauth2/authorize

Source: https://docs.idura.app/verify/reference/authorization-flows/implicit-flow

The Implicit flow authorization endpoint that returns an ID token directly in the URL fragment.

```APIDOC
## GET /oauth2/authorize

### Description
Initiates the Implicit flow by redirecting the user to the authorization endpoint. The ID token is returned directly in the URL fragment.

### Method
GET

### Endpoint
https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Must be `id_token`.
- **response_mode** (string) - Required - Must be `fragment`.
- **client_id** (string) - Required - Your client ID.
- **redirect_uri** (string) - Required - The URL to redirect to after authentication.
- **acr_values** (string) - Required - The chosen identity service.
- **scope** (string) - Required - Must include `openid`.
- **state** (string) - Required - A value to maintain state between the request and callback.

### Request Example
```
GET https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?response_type=id_token&response_mode=fragment&client_id=CLIENT_ID&redirect_uri=YOUR_REDIRECT_URL&acr_values=CHOSEN_IDENTITY_SERVICE&scope=openid&state=YOUR_STATE
```

### Response
#### Success Response (302)
- **Location** (string) - The redirect URL containing the ID token and state in the fragment.

#### Response Example
```
HTTP/1.1 302 Found
Location: YOUR_REDIRECT_URL#id_token=eyJ[...].eyJ[...].Sfl[...]&state=[...]
```
```

--------------------------------

### BrowserManager initializer

Source: https://docs.idura.app/verify/integrations/swift

Initializes a BrowserManager for presenting the authorization URL.

```APIDOC
## [SDK] BrowserManager initializer

### Description
Creates a `BrowserManager` instance to present an authorization URL and receive the callback URL.

### Method
init(redirectUri:useEphemeralBrowserSession:)

### Parameters
- **redirectUri** (URL) - Required - The callback URL that must be an `https://` URL on a domain configured as an Associated Domain.
- **useEphemeralBrowserSession** (Bool) - Required - Whether to use an ephemeral browser session.

### Errors
- **BrowserManagerError.configurationError** - Thrown if `redirectUri` does not use the `https` scheme.

### Example
```swift
let browser = try BrowserManager(
  redirectUri: URL(string: "https://your-domain.idura.broker/ios/callback")!,
  useEphemeralBrowserSession: true
)
```
```

--------------------------------

### GET /FederationMetadata/2007-06/FederationMetadata.xml

Source: https://docs.idura.app/verify/guides/work-with-metadata

Retrieves WS-Federation metadata in ADFS-style format. This endpoint returns the same data as the shorthand metadata endpoint.

```APIDOC
## GET /FederationMetadata/2007-06/FederationMetadata.xml

### Description
Retrieves WS-Federation metadata in ADFS-style format. This endpoint returns the same data as the shorthand metadata endpoint.

### Method
GET

### Endpoint
https://yourdomain.idura.broker/FederationMetadata/2007-06/FederationMetadata.xml

### Response
#### Success Response (200)
- **metadata** (XML) - WS-Federation metadata document

#### Response Example
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">...</EntityDescriptor>
```

--------------------------------

### Configure expo-build-properties and @criipto/verify-expo in app.json

Source: https://docs.idura.app/verify/integrations/react-native-expo

Configure both plugins in app.json. expo-build-properties must appear before @criipto/verify-expo so its overrides are applied first. The plugin fails expo prebuild with copy-paste-friendly errors if requirements are unmet.

```json
"plugins": [
  ["expo-build-properties", {
    "android": { "minSdkVersion": 26 },
    "ios": { "useFrameworks": "dynamic", "deploymentTarget": "17.4" }
  }],
  ["@criipto/verify-expo", {
    "domain": "YOUR_IDURA_DOMAIN",
    "clientID": "urn:my:application:identifier:XXXX"
  }]
]
```

--------------------------------

### GET /metadata/wsfed

Source: https://docs.idura.app/verify/guides/work-with-metadata

Retrieves WS-Federation metadata for the identity broker. This endpoint returns the same data as the ADFS-style metadata endpoint.

```APIDOC
## GET /metadata/wsfed

### Description
Retrieves WS-Federation metadata for the identity broker. This endpoint returns the same data as the ADFS-style metadata endpoint.

### Method
GET

### Endpoint
https://yourdomain.idura.broker/metadata/wsfed

### Response
#### Success Response (200)
- **metadata** (XML) - WS-Federation metadata document

#### Response Example
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">...</EntityDescriptor>
```

--------------------------------

### Instantiate IduraVerify

Source: https://docs.idura.app/verify/integrations/swift

Create an IduraVerify instance using the client ID and domain from your Info.plist. The initializer throws IduraVerifyConfigurationError.invalidDomain if the domain is not a bare hostname.

```swift
let iduraVerify = try IduraVerify(
    clientId: Bundle.main.object(forInfoDictionaryKey: "IDURA_CLIENT_ID") as! String,
    domain: Bundle.main.object(forInfoDictionaryKey: "IDURA_DOMAIN") as! String,
)
```

--------------------------------

### Fetch GraphQL schema with curl

Source: https://docs.idura.app/signatures/graphql/endpoints

Executes a GET request to the GraphQL endpoint to retrieve the schema for build/codegen tools.

```bash
curl https://signatures.idura.app/v1/graphql
```

--------------------------------

### Authorize Request with Scopes

Source: https://docs.idura.app/verify/e-ids/vipps-mobilepay

Example of an OAuth2 authorize request using the scope parameter to request Vipps MobilePay claims.

```APIDOC
## GET /oauth2/authorize

### Description
Initiates the OAuth2 authorization flow with Vipps MobilePay, requesting specific user claims via the `scope` parameter.

### Method
GET

### Endpoint
`https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize`

### Parameters
#### Query Parameters
- **scope** (string) - Required - Space-separated list of requested scopes. Example: `openid phone ssn`.

### Request Example
```
https://YOUR_SUBDOMAIN.idura.broker/oauth2/authorize?scope=openid phone ssn&...
```

### Response
#### Success Response (302)
Redirects to the authorization server with the authorization code.

#### Response Example
No response body; the user is redirected.
```

--------------------------------

### Initialize IduraVerify with custom callback URL

Source: https://docs.idura.app/verify/integrations/swift

Shows how to pass a custom callback URL when initializing the SDK. The domain and client ID are read from the app's Info.plist, and the redirect URI is constructed by appending a custom path to the domain.

```swift
let domain = Bundle.main.object(forInfoDictionaryKey: "IDURA_DOMAIN") as! String
let iduraVerify = try IduraVerify(
  clientId: Bundle.main.object(forInfoDictionaryKey: "IDURA_CLIENT_ID") as! String,
  domain: domain,
  redirectUri: URL(string: "https://" + domain)!.appendingPathComponent("/my/custom/callback")
)
```

--------------------------------

### Access JWT claims

Source: https://docs.idura.app/verify/integrations/swift

Accesses JWT claims using the `getClaimValue` method. The example shows how to retrieve the `address` claim and extract the `street_address`.

```swift
let address = result.jwt.getClaimValue(key: "address") as? [String: Any]
let streetAddress = address?["street_address"]
```

--------------------------------

### Initialize IduraVerify and handle errors

Source: https://docs.idura.app/verify/integrations/swift

Shows the SDK initialization with Danish MitID and error handling for user cancellation, OAuth errors, and other SDK failures. IduraVerifyError conforms to LocalizedError, so localizedDescription provides a meaningful string for logging.

```swift
do {
  let result = try await iduraVerify.login(eid: DanishMitID.substantial())
  // ...
} catch IduraVerifyError.userCancelled(let traceId) {
  // User dismissed the browser or the IdP returned `access_denied`. Usually a normal
  // action — quietly return them to the previous screen rather than showing an error.
  _ = traceId
} catch IduraVerifyError.oauth(let error, let errorDescription, let traceId) {
  // The IdP returned a non-cancellation OAuth error. `error` is the OAuth 2.0 error code,
  // `errorDescription` is the optional human-readable text.
  _ = (error, errorDescription, traceId)
} catch let err as IduraVerifyError {
  // Catch-all for SDK-internal failures (PAR, JWT verification, browser plumbing). Treat
  // as unrecoverable; surface a generic error to the user and log `err.traceId`.
}
```

--------------------------------

### GraphQL query for signatory webhook

Source: https://docs.idura.app/signatures/webhooks/events

GraphQL query example for retrieving signatory status and signature order ID, useful for webhook handling.

```graphql
query SignatoryWebhook($signatoryId: ID!) {   signatory(id: $signatoryId) {     status      signatureOrder {       id     }   } }
```

--------------------------------

### GET /metadata/wsfed/{BASE64(wauth)}

Source: https://docs.idura.app/verify/guides/work-with-metadata

Retrieves WS-Federation metadata specific to a login method. The path segment is a base64-encoded value of the `wauth` parameter.

```APIDOC
## GET /metadata/wsfed/{BASE64(wauth)}

### Description
Retrieves WS-Federation metadata specific to a login method. The path segment is a base64-encoded value of the `wauth` parameter.

### Method
GET

### Endpoint
https://yourdomain.idura.broker/metadata/wsfed/{BASE64(wauth)}

### Parameters
#### Path Parameters
- **BASE64(wauth)** (string) - Required - Base64-encoded value of the `wauth` parameter.

### Response
#### Success Response (200)
- **metadata** (XML) - WS-Federation metadata document for the specified login method

#### Response Example
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata">...</EntityDescriptor>
```

--------------------------------

### Warm up the native SDK with warmUp()

Source: https://docs.idura.app/verify/integrations/react-native-expo

Call warmUp() from an effect on the screen that logs in to build the native SDK on the first login() call. It is optional, never throws, and is cheap to call more than once. A misconfigured app still fails at login() with ModuleNotConfiguredError; the native side logs the reason under the CriiptoVerifyExpo tag (logcat) or via NSLog.

```javascript
import { useEffect } from "react";
import { warmUp } from "@criipto/verify-expo";

useEffect(() => {
  warmUp();
}, []);
```
Tokens:
Raw