Getting Started

Welcome! If you are new to ID.me, you are in the right place. Here we will cover how to get started using ID.me.

Overview

To get started with an integration you’ll need to do the following.

1. 1. Sign up for an ID.me developer account. Click here
2. 2. Register your organization.
3. 3. Select which groups you would like to enable for verification.
4. 4. Choose your platform to review the recommended integration options.
5. 5. Place our Verify with ID.me (Click to download) button on your site to begin testing authentication and verification.
   1. i. Contact partnersupport@id.me to generate test credentials.
6. 6. Once verification is complete at ID.me, the partner sends a request to ID.me’s API to retrieve user attributes.

By default, your application will be set up for OAuth. Upon registration, you will immediately have access to the application details page which will list the client_id and client_secret for your OAuth client.

Leveraging the ID.me IDP SAML service will vary depending on the product that is used to implement the federation relationship. Currently, we do not support creating SAML SP profiles automatically through the portal, please contact partnersupport@id.me for assistance in the process.

Verification Products

Digital Identity Verification

• Online identity proofing securely verifies an individual’s identity in minutes using remote verification of physical IDs, mobile network operator (MNO) data, along with fraud and compliance checks.
• Virtual In-person proofing allows those individuals to complete identity proofing with a trained Trusted Referee via a simple video conference session.
• In-person proofing with a Trusted Referee ensures that all users can easily create a credential to secure access to high value services online.

Group Affiliation Verification

• Instantly verify customer eligibility for exclusive discounts
• Acquire customers and build loyalty in strategic customer segments, while reducing discount fraud.

EPCS and eRX Provider Verification

• Verify physician identity and medical provider status for EPCS
• ID.me provides seamless identity verification for Health Care Providers to meet Electronic Prescription of Controlled Substances (EPCS) requirements.

Document Verification

• Verify the authenticity of ID documents with machine vision and AI
• Easy Document Verification for REAL ID Applicants.
• Instantly verify the identity of consumers who submit Subject Rights Requests (SRR) or Data Subject Access Requests (DSAR).

Know Your Customer Account Opening

• Implement KYC verification to streamline the online account opening process.
• Improve conversion for account opening with simple remote verification of physical IDs and mobile phone SIM verification.

SCRA Compliance Montioring

• Instant SCRA Verification for Financial Institutions.
• Rely on automated SCRA monitoring to ensure compliance for loans and debt collection. Minimize cost and regulatory burden.

Industry standards ID.me supports

Open Authorization (OAuth) 2

1. An authorization standard that allows a user to grant limited access to their resources on one site, to another site, without having to expose their credentials. You use this standard every time you log in to a site using your Google account and you are asked if you agree with sharing your email address and your contacts list with that site.

OpenID Connect (OIDC)

1. An identity layer that sits on top of OAuth 2 and allows for easy verification of the user's identity, as well as the ability to get basic profile information from the identity provider.

Security Assertion Markup Language (SAML)

1. An open-standard, XML-based data format that allows businesses to communicate user authentication and authorization information to partner companies and enterprise applications their employees may use.

Bearer Token Authentication

1. An HTTP authentication scheme that involves security tokens called bearer tokens.

Keep reading

1. Begin Digital Identity integration
2. Begin Group Affiliation integration
3. Begin EPCS Provider integration
4. Begin Document Verification integration
5. Begin KYC integration

SAML Metadata

Once an account is created, SAML metadata (along with keys) must be exchanged to ensure proper configuration of the endpoints.

A copy of the current, full metadata is always available at https://api.id.me/saml/metadata/provider

Sandbox environment metadata can be found at https://api.idmelabs.com/saml/metadata/provider

The metadata document describes the IDP to a SP, including the following elements:

• The endpoint addresses for communication
• The X.509 certificates being used to sign and encrypt SAML assertions
• The SAML bindings supported by the service provider

SAML Bindings

The ID.me IDP SAML service supports HTTP POST and HTTP Redirect bindings.

Name Identifier

The ID.me IDP SAML service supports the following NameID formats:

urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

Authentication Context

The ID.me IDP SAML service supports invoking different authentication and verification policies on a per-application or per-request basis. The policy name is required to be passed along within the element. For more information about available policies and support for setting these up, please contact partnersupport@id.me

SAML is a secure protocol, which supports encryption and message signing. In addition, the HTTP communication security between the SP and the IDP is ensured by using SSL (TLS v1.1 or higher).

XML Signature

All ID.me SAML messages are digitally signed. This includes all requests, assertions and metadata. The XML signature is contained within the element. The signature serves as proof that only the IDP could have signed the element, and also to guarantee the integrity of the assertion. ID.me signs messages using SHA256, SHA384 and SHA512 algorithms.

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                ID="_67016ed111db-4bce-b065-45bcd564cd0e"
                Version="2.0"
                IssueInstant="2015-02-04T22:30:48Z"
                Destination="..."
                Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                InResponseTo="_6a12a9ef28696226601602f669545e7ebb1c80d19a">
    <saml:Issuer>api.id.me</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>...</ds:SignedInfo>
        <ds:SignatureValue>...</ds:SignatureValue>
        <ds:KeyInfo>...</ds:KeyInfo>
    </ds:Signature>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </samlp:Status>
    <saml:Assertion ID="_d20913189703-4b8b-97f4-c96ef7b1dccd" Version="2.0" IssueInstant="2015-02- 04T22:30:46Z">...</saml:Assertion>
</samlp:Response>

XML Encryption

ID.me requires all SAML assertions to be encrypted. This ensures the privacy of any confidential data contained within the response transmission. The encrypted assertion is contained within the element.

ID.me supports using AES-128, AES-192 and AES-256 as message encryption algorithms.

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                ID="_46965880a3f0-461b-bc99-5ba262e812b3"
                Version="2.0"
                IssueInstant="2015-02-04T22:46:25Z"
                Destination="..."
                Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                InResponseTo="_8bf72df7b4922883b1adad99926a0293c6e135b6da">
  <saml:Issuer>idp-staging.idmeinc.net</saml:Issuer>
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">...</ds:Signature>
  <samlp:Status>
      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
  </samlp:Status>
  <saml:EncryptedAssertion>
    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Id="_43a44a93ad36-4616-
    b1e6-2a96d4f3134c" Type="http://www.w3.org/2001/04/xmlenc#Element">
      <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
          <xenc:EncryptedKey Id="_78c2d92d0c46-4820-b8f0-52698580d7c9">
              <xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" />
              <xenc:CipherData>
                  <xenc:CipherValue>...</xenc:CipherValue>
              </xenc:CipherData>
          </xenc:EncryptedKey>
      </ds:KeyInfo>
      <xenc:CipherData>
          <xenc:CipherValue>...</xenc:CipherValue>
      </xenc:CipherData>
    </xenc:EncryptedData>
  </saml:EncryptedAssertion>
</samlp:Response>