Upon application registration, you will immediately have access to the application details page which will list the
needed to configure your OAuth client.
to provide authorized access to its API. We currently use
OAuth 2 draft-22.
This section describes how you can use the OAuth 2 protocol to to gain access to a user's group affiliation data.
Requests to retrieve user data require an
that is used to query ID.me's REST API. These tokens are unique to a user and should be stored securely.
Access tokens expire
after being issued.
The following diagram shows an overview of the OAuth flow. The "RP" in this diagram stands for "Relying Party", a.k.a the partner.
In order to get an
you must do the following:
redirect_uriand you can retrieve the
access_tokenin one of two ways:
codeparameter in the redirect and exchange it for an
access_tokenby POSTing the code to our access token request endpoint.
access_tokenas a fragment (#) in the redirect. This method allows applications without any server component to receive an
The typical flow begins at one of our partner websites, where an end user may see an ID.me verification button during registration or in the checkout flow.