Welcome to ID.me for developers! If you are interested in integrating ID.me, you are in the right place. Here we will cover how to get started implementing ID.me.

OAuth 2.0 Authorization Flows

Using OAuth 2.0 Authorization Framework, organizations can allow users to authenticate and approve an authorization to provide access their verificartion credential. With ID.me, you can easily support different flows in your own applications and APIs without worrying about OAuth 2.0 specifications or other technical aspects of authentication and authorization. We support scenarios for server-side, mobile, desktop, client-side, and device applications.

Authorization Code Flow

Because regular web apps are server-side apps where the source code is not publicly exposed, they can use the Authorization Code Flow, which exchanges an Authorization Code for a token.

Learn More
Oauth auth code dataflow
Authorization Code Flow with Encrypted Responses

During authentication, mobile and native applications can use the Authorization Code Flow, but they require additional security. Additionally, single-page apps have special challenges. To mitigate these, OAuth 2.0 provides a version of the Authorization Code Flow which makes use of a Proof Key for Code Exchange (PKCE).

Learn More
Oauth auth code encrypted dataflow
Implicit Flow

As an alternative to the Authorization Code Flow, OAuth 2.0 provides the Implicit Flow, which is intended for Public Clients, or applications which are unable to securely store Client Secrets. While this is no longer considered a best practice for requesting Access Tokens, when used with Form Post response mode, it does offer a streamlined workflow if the application needs only an ID token to perform user authentication.

Learn More
Oauth access token dataflow