Developers ========== Here you find everything you need to implement the BankID services in a secure and user friendly way. Start from the top and get acqainted with our platform, or if you already know what it's about, dive straight into the section you need.  Start ### Good to know before you get going  [Getting started](https://developers.bankid.com/getting-started/introduction) APIs ### Why wait? Go straight to the core  [API references](https://developers.bankid.com/api-references/auth--sign/overview) Test ### Make sure everything works as expected [Testing](https://developers.bankid.com/test-portal/test-information) Popular topics -------------- [Latest news - Read the lastest updates from us. ](https://developers.bankid.com/news)  [Use cases - Common use cases and the differences between them. ](https://developers.bankid.com/use-cases/mobile-bankid-on-the-same-device)  [QR code - All about the animated QR codes. ](https://developers.bankid.com/how-to-guides/qr-code)  [Autostart - How to start BankID in browsers and native apps. ](https://developers.bankid.com/how-to-guides/autostart)  [Signatures - For auth & sign as well as Verification of digital ID card.](https://developers.bankid.com/how-to-guides/verifying-signatures) [Environments - All info about the test- and production environments. ](https://developers.bankid.com/getting-started/environments)  [Certificates - Certificates are central in our services. This is how to get one.  ](https://developers.bankid.com/getting-started/order-certificate/request-a-certificate)   [Digital ID card - Overview for Verification of a digital ID card. ](https://developers.bankid.com/api-references/digital-id-card/overview) Support ======= If you can't find what you are looking for on this site, please send an email to [teknikinfo@bankid.com](mailto:teknikinfo@bankid.com) In non-technical matters, please contact the party you have your agreement about the BankID service with.  FAQs ------ Can you review my code to see why it doesn't work? We don't have capacity to review and troubleshoot third party code. The general principles of integration and methods to be used are described on this site. If you can't find what you are looking for on this site, please send an email to [teknikinfo@bankid.com](mailto:teknikinfo@bankid.com) for guidance. How can I find out if the BankID service is up and running? You find the service status on the top right side of the bankid.com website. If you click that information field you'll land on a page with more information, such as previous, ongoing and planned downtime. You can also sign up for our [technical newsletter](https://developers.bankid.com/news/technical-newsletter) to get tips and information about the service and changes made. How do I give Apple/Google reviewers access to our app when they don't have BankID? As a developer of a service app, you need to ensure that Apple and Google can test the app in order to approve it for distribution. If most of the functionality is "behind" BankID login, you can ask Apple/Google in your review instructions to retrieve a test BankID from the demo bank (provided you have configured the service app for test BankID), or build in a demo mode that gives Apple/Google opportunity to test the app. How do I install and configure BankID in corporate environments? Here you find more information about the [Enterprise version](https://www.bankid.com/en/foretag/enterprise). How do I integrate BankID into my e-services? To use BankID, you need an agreement with a selling bank. You also need to perform a technical integration. [Read about the process and find selling banks](https://www.bankid.com/en/foretag/anslut-foeretag) How do I order and install the needed certificates? To communicate with our service, you need to add our CA root certificate in your truststore to trust our server certificate. How to do this differs slightly depending on your environment. If this isn't done you typically get various SSL/TLS errors. For authentication to the BankID service, certificate authentication is used and your application need to use a client certificate stored in your keystore. If this isn't done you typically get various SSL/TLS errors. This is issued by the same bank you purchased the service from. You don't need to install additional CA certificates to use the client certificate. [Read more about testing](https://developers.bankid.com/test-portal/test-information) How do I test my BankID implementation? How about automation? Testing can't be automated. Passwords/Security codes have to be manually entered in the BankID clients. We recommend building a so-called test stub that simulates the BankID service web service. It can also be used to perform load tests on your services.  [Read more about testing](https://developers.bankid.com/test-portal/test-information) I have technical questions about BankID. Can you call me? Unfortunately, we don't have phone support. To use BankID in your service, you need an agreement with one of the banks that sells the BankID service. In addition, you need to make the technical integration of BankID in your service. You find all the technical information on this site.  [How to connect your business](https://www.bankid.com/en/foretag/anslut-foeretag) Why doesn't the test environment work? If you try to log in or sign in the test environment, but no sign-in or signing dialog appears in the BankID app, it's probably caused by one of the following: * The BankID app in the phone isn't configured for testing. Note that you must uninstall and reinstall the app to configure it for testing. [Read instructions here](https://developers.bankid.com/test-portal/bankid-for-test). * There's no test BankID on the phone. [Read more about test BankID](https://developers.bankid.com/test-portal/bankid-for-test). * The call from your service is made to the production environment instead of the test environment. If you make a call to the production environment, the login will never appear in an app configured for testing. * You havn't installed the correct certificates to reach the test environment in your truststore and keystore. Note that there are different certificates for the test and production environments. . * A useful tip is to test at [Demo bank](https://demo.bankid.com/). Select “Log in with a Test BankID”. If that works, your client is correctly configured for test and you have a working test BankID. In this case the problem is likely to be found in your implementation.  Do you provide sample code? There are some code snippets available on this site, both on content pages and in the API specifications.  What does error 10026 mean? Error code 10026 on a PC or MAC is probably occuring because you havn't configured the BankID Security Application for test. [Read instructions here](https://developers.bankid.com/test-portal/bankid-for-test).  My animated QR code doesn't work. What could be wrong? The most common mistakes when it comes to the animated QR code are:  * Your animated QR-code and your client are communicating with different environments. Make sure your client is configured for test when testing.  * The QR code is too old. Your service should update the QR code every second. The codes should be generated continuously, not in advance since pre-generation would lower security.  * The ‘QR code error correction level’ is set to 'high', wheras it could be better to set it to 'low'.  [Read instructions here](https://developers.bankid.com/how-to-guides/qr-code) Introduction ============ BankID is an eID. We provide secure digital identification and signature as well as a digital ID card. Before implementing our services, you need to have an agreement with one of the reseller banks. [Read about connecting to BankID](https://www.bankid.com/foretag/anslut-foretag)  For the technical implementation you'll need:   * A **certificate**, which is ordered from the bank you have your BankID agreement with.  * A **backend** part that communicates with the frontend as well as with the BankID service.   * A **frontend** part that can display information for the users.   About our services -------------------- We provide solutions for fast and secure digital identification and signature, as well as an option for end users to activate a digital ID card. * **Identification**: Equivalent to presenting a physical ID but in a digital context. Often used to identify individuals when they log on to an online service. Can be used in e-services as well as in phone calls. [API overview](https://developers.bankid.com/api-references/auth--sign/overview) * **Signature**: Equivalent to making a physical signature but in a digital context. Often used for signing online payments, contracts or other agreements. Can be used in e-services as well as in phone calls. [API overview](https://developers.bankid.com/api-references/auth--sign/overview) * **Digital ID card**: An ID card in the BankID app that end users can have as a substitute for a physical ID card. You can verify the digital ID card in several ways, one being through the API Verification of digital ID card, read more below. ### Client platforms and system requirements ### Mobile BankID Mobile BankID is available for: * iOS 16 and later * Android 9 or higher ### BankID on file and card BankID on file and card are available for: * Windows 10 and later * Internet Explorer version 11 and later * Microsoft Edge latest version * Mozilla Firefox latest version * Google Chrome latest version * macOS 10.15 and later, on Intel and Apple M1 platforms * Safari latest version * Mozilla Firefox latest version * Google Chrome latest version ### Verification of our digital ID card To verify the digital ID card, use the API 'Verification of digital ID card'. When an end user shows their digital ID card, an animated QR code is shown on the screen. By scanning the QR code using i.e. a scanner connected to our services, the same verification process as an ordinary identification with BankID eID service is executed. Resources and guidance ------------------------ On this site you find instructions for how to implement our services and specific functionality connected to them. There are guides available, a [test portal](https://developers.bankid.com/test-portal/testing) and you'll find some code snippets on content pages as well as in the API references. Environments ============ On this page you find general information about certificates in our services, and information about the production- and test environments. Please note that you need to use different certificates for these two environments. The certificate for the test environment can be downloaded here, but the one for the production environment must be ordered from the bank you have your agreement about our services with.  About certificates -------------------- Our services are certificate based and you need a valid certificate to use them. Certificates are used both to identify your company and for showing which service an end user is identifying themselves with or signing information at.  Your certificate must be installed/configured in your “key store”. It doesn't need to be verified by your application and the issuer of the certificate isn't needed. Our server will present its own server certificate to your application, and verification of your certificate will be performed during a TLS handshake when the channel is established. However, our server certificate needs to be verified by your application. To make the verification possible, the issuer of the server certificate needs to be installed/configured in your “trust store”. Key stores and trust stores are managed differently depending on your environment and are not explained here.  ### **Good to know** * Different certificates are used for production and test.  * The certificates may need to be converted to a different file format to be accepted by your environment. * Your application needs access to your key store and trust store and your application needs to use correct key store and trust store. * Line breaks may need to be removed from the issuer of the server certificate pasted from this site.  Production environment ------------------------ ### Web service URLs * **Auth and sign**: https://appapi2.bankid.com/  * **Verification of digital ID card**: https://idcardapi.bankid.com/  ### Certificate for production The certificate for the production environment is provided by the bank you have a BankID agreement with. [Read more about certificates](https://developers.bankid.com/getting-started/order-certificate/request-a-certificate) You must use the _issuer_ of the certificate as trusted root. If the certificate is used as trusted, your service won't be able to access our server when the certificate is changed. #### Issuer of production certificate The production certificate is issued by the following CA: CN = BankID SSL Root CA v1 OU = Infrastructure CA O = Finansiell ID-Teknik BID AB  -----BEGIN CERTIFICATE----- MIIFvjCCA6agAwIBAgIITyTh/u1bExowDQYJKoZIhvcNAQENBQAwYjEkMCIGA1UE CgwbRmluYW5zaWVsbCBJRC1UZWtuaWsgQklEIEFCMRowGAYDVQQLDBFJbmZyYXN0 cnVjdHVyZSBDQTEeMBwGA1UEAwwVQmFua0lEIFNTTCBSb290IENBIHYxMB4XDTEx MTIwNzEyMzQwN1oXDTM0MTIzMTEyMzQwN1owYjEkMCIGA1UECgwbRmluYW5zaWVs bCBJRC1UZWtuaWsgQklEIEFCMRowGAYDVQQLDBFJbmZyYXN0cnVjdHVyZSBDQTEe MBwGA1UEAwwVQmFua0lEIFNTTCBSb290IENBIHYxMIICIjANBgkqhkiG9w0BAQEF AAOCAg8AMIICCgKCAgEAwVA4snZiSFI3r64LvYu4mOsI42A9aLKEQGq4IZo257iq vPH82SMvgBJgE52kCx7gQMmZ7iSm39CEA19hlILh8JEJNTyJNxMxVDN6cfJP1jMH JeTES1TmVbWUqGyLpyT8LCJhC9Vq4W3t/O1svGJNOUQIQL4eAHSvWTVoalxzomJh On97ENjXAt4BLb6sHfVBvmB5ReK0UfwpNACFM1RN8btEaDdWC4PfA72yzV3wK/cY 5h2k1RM1s19PjoxnpJqrmn4qZmP4tN/nk2d7c4FErJAP0pnNsll1+JfkdMfiPD35 +qcclpspzP2LpauQVyPbO21Nh+EPtr7+Iic2tkgz0g1kK0IL/foFrJ0Ievyr3Drm 2uRnA0esZ45GOmZhE22mycEX9l7w9jrdsKtqs7N/T46hil4xBiGblXkqKNG6TvAR k6XqOp3RtUvGGaKZnGllsgTvP38/nrSMlszNojrlbDnm16GGoRTQnwr8l+Yvbz/e v/e6wVFDjb52ZB0Z/KTfjXOl5cAJ7OCbODMWf8Na56OTlIkrk5NyU/uGzJFUQSvG dLHUipJ/sTZCbqNSZUwboI0oQNO/Ygez2J6zgWXGpDWiN4LGLDmBhB3T8CMQu9J/ BcFvgjnUyhyim35kDpjVPC8nrSir5OkaYgGdYWdDuv1456lFNPNNQcdZdt5fcmMC AwEAAaN4MHYwHQYDVR0OBBYEFPgqsux5RtcrIhAVeuLBSgBuRDFVMA8GA1UdEwEB /wQFMAMBAf8wHwYDVR0jBBgwFoAU+Cqy7HlG1ysiEBV64sFKAG5EMVUwEwYDVR0g BAwwCjAIBgYqhXBOAQQwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBDQUAA4IC AQAJOjUOS2GJPNrrrqf539aN1/EbUj5ZVRjG4wzVtX5yVqPGcRZjUQlNTcfOpwPo czKBnNX2OMF+Qm94bb+xXc/08AERqJJ3FPKu8oDNeK+Rv1X4nh95J4RHZcvl4AGh ECmGMyhyCea0qZBFBsBqQR7oC9afYOxsSovaPqX31QMLULWUYoBKWWHLVVIoHjAm GtAzMkLwe0/lrVyApr9iyXWhVr+qYGmFGw1+rwmvDmmSLWNWawYgH4NYxTf8z5hB iDOdAgilvyiAF8Yl0kCKUB2fAPhRNYlEcN+UP/KL24h/pB+hZ9mvR0tM6nW3HVZa DrvRz4VihZ8vRi3fYnOAkNE6kZdrrdO7LdBc9yYkfQdTcy0N+Aw7q4TkQ8npomrV mTKaPhtGhA7VICyRNBVcvyoxr+CY7aRQyHn/C7n/jRsQYxs7uc+msq6jRS4HPK8o lnF9usWZX6KY+8mweJiTE4uN4ZUUBUtt8WcXXDiK/bxEG2amjPcZ/b4LXwGCJb+a NWP4+iY6kBKrMANs01pLvtVjUS9RtRrY3cNEOhmKhO0qJSDXhsTcVtpbDr37UTSq QVw83dReiARPwGdURmmkaheH6z4k6qEUSXuFch0w53UAc+1aBXR1bgyFqMdy7Yxi b2AYu7wnrHioDWqP6DTkUSUeMB/zqWPM/qx6QNNOcaOcjA== -----END CERTIFICATE----- Test environment ------------------ We provide a test environment for you to use when developing and testing your service. To use the test environment, you need to:  1. Have a certificate for the test environment.  2. Use the BankID JSON web service API URL.  3. Trust the issuer of the certificate.  4. Have a BankID app configured for test.  5. Have a test BankID. ### Web service URLs * **eID service**: https://appapi2.test.bankid.com/ * **Digital ID card**: https://idcardapi.test.bankid.com/ ### Certificate for test You can download the certificate for test on the [testing page](https://developers.bankid.com/test-portal/test-information). #### Issuer of test certificate The test certificate is issued by the following CA:  CN = Test BankID SSL Root CA v1 Test OU = Infrastructure CA O = Finansiell ID-Teknik BID AB  -----BEGIN CERTIFICATE----- MIIF0DCCA7igAwIBAgIIIhYaxu4khgAwDQYJKoZIhvcNAQENBQAwbDEkMCIGA1UE CgwbRmluYW5zaWVsbCBJRC1UZWtuaWsgQklEIEFCMRowGAYDVQQLDBFJbmZyYXN0 cnVjdHVyZSBDQTEoMCYGA1UEAwwfVGVzdCBCYW5rSUQgU1NMIFJvb3QgQ0EgdjEg VGVzdDAeFw0xNDExMjExMjM5MzFaFw0zNDEyMzExMjM5MzFaMGwxJDAiBgNVBAoM G0ZpbmFuc2llbGwgSUQtVGVrbmlrIEJJRCBBQjEaMBgGA1UECwwRSW5mcmFzdHJ1 Y3R1cmUgQ0ExKDAmBgNVBAMMH1Rlc3QgQmFua0lEIFNTTCBSb290IENBIHYxIFRl c3QwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCAKWsJc/kV/0434d+S qn19mIr85RZ/PgRFaUplSrnhuzAmaXihPLCEsd3Mh/YErygcxhQ/MAzi5OZ/anfu WSCwceRlQINtvlRPdMoeZtu29FsntK1Z5r2SYNdFwbRFb8WN9FsU0KvC5zVnuDMg s5dUZwTmdzX5ZdLP7pdgB3zhTnra5ORtkiWiUxJVev9keRgAo00ZHIRJ+xTfiSPd Jc314maigVRQZdGKSyQcQMTWi1YLwd2zwOacNxleYf8xqKgkZsmkrc4Dp2mR5Pkr nnKB6A7sAOSNatua7M86EgcGi9AaEyaRMkYJImbBfzaNlaBPyMSvwmBZzp2xKc9O D3U06ogV6CJjJL7hSuVc5x/2H04d+2I+DKwep6YBoVL9L81gRYRycqg+w+cTZ1TF /s6NC5YRKSeOCrLw3ombhjyyuPl8T/h9cpXt6m3y2xIVLYVzeDhaql3hdi6IpRh6 rwkMhJ/XmOpbDinXb1fWdFOyQwqsXQWOEwKBYIkM6cPnuid7qwaxfP22hDgAolGM LY7TPKUPRwV+a5Y3VPl7h0YSK7lDyckTJdtBqI6d4PWQLnHakUgRQy69nZhGRtUt PMSJ7I4Qtt3B6AwDq+SJTggwtJQHeid0jPki6pouenhPQ6dZT532x16XD+WIcD2f //XzzOueS29KB7lt/wH5K6EuxwIDAQABo3YwdDAdBgNVHQ4EFgQUDY6XJ/FIRFX3 dB4Wep3RVM84RXowDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBQNjpcn8UhE Vfd0HhZ6ndFUzzhFejARBgNVHSAECjAIMAYGBCoDBAUwDgYDVR0PAQH/BAQDAgEG MA0GCSqGSIb3DQEBDQUAA4ICAQA5s59/Olio4svHXiKu7sPQRvrf4GfGB7hUjBGk YW2YOHTYnHavSqlBASHc8gGGwuc7v7+H+vmOfSLZfGDqxnBqeJx1H5E0YqEXtNqW G1JusIFa9xWypcONjg9v7IMnxxQzLYws4YwgPychpMzWY6B5hZsjUyKgB+1igxnf uaBueLPw3ZaJhcCL8gz6SdCKmQpX4VaAadS0vdMrBOmd826H+aDGZek1vMjuH11F fJoXY2jyDnlol7Z4BfHc011toWNMxojI7w+U4KKCbSxpWFVYITZ8WlYHcj+b2A1+ dFQZFzQN+Y1Wx3VIUqSks6P7F5aF/l4RBngy08zkP7iLA/C7rm61xWxTmpj3p6SG fUBsrsBvBgfJQHD/Mx8U3iQCa0Vj1XPogE/PXQQq2vyWiAP662hD6og1/om3l1PJ TBUyYXxqJO75ux8IWblUwAjsmTlF/Pcj8QbcMPXLMTgNQAgarV6guchjivYqb6Zr hq+Nh3JrF0HYQuMgExQ6VX8T56saOEtmlp6LSQi4HvKatCNfWUJGoYeT5SrcJ6sn By7XLMhQUCOXcBwKbNvX6aP79VA3yeJHZO7XParX7V9BB+jtf4tz/usmAT/+qXtH CCv9Xf4lv8jgdOnFfXbXuT8I4gz8uq8ElBlpbJntO6p/NY5a08E6C7FWVR+WJ5vZ OP2HsA== -----END CERTIFICATE----- ### Network information The BankID app for Android, iOS, macOS and Windows for test all connect to the BankID server on the IP adresses:  * 185.198.6.16 using port 443 and  * 185.198.6.14 using port 80 The BankID app for macOS and Windows also connects on IP adress 141.226.253.92 using port 80.  ### Test BankID and test configuration * [Issue a test BankID](https://developers.bankid.com/test-portal/testing) * [How to do the configuration for test](https://developers.bankid.com/test-portal/bankid-for-test) Request a certificate ===================== The steps for ordering your certificate are:  1. Create the request with BankID Keygen.  2. Send the request.  3. Receive the issued certificate.  4. Create the PKCS#12 / PFX file.  You'll find more detailed information below.  BankID Keygen --------------- To run the BankID Keygen software you need to start a command prompt or terminal application for your operating system (Windows or Linux). You don’t need to install anything to run this application. The new version from January 2025 should help mitigate issues with anti-virus program warnings. ### Windows [Download Keygen for Windows](https://cdn.bankid.com/tools/keygen/keygen-windows-2.3.6.exe) **Details:** File Name: keygen-windows\_2\_3\_6.exe File Size: 5.7 MB Date Published: 20/10/2025 SHA256SUM: fd3dcf546e87a741662d8936c0886acb9147b611310d7d16c1535e660407b881 ### Linux [Download Keygen for Linux](https://cdn.bankid.com/tools/keygen/keygen-linux-amd64-2.3.6) **Details:** File Name: keygen-linux-amd64\_2\_3\_6 File Size: 5.6 MB Date Published: 20/10/2025 SHA256SUM: 30f691a204f8e0c2cc3ea1f70f747d9eaa74d4b51b9a969e254e0736bf4b86a3 Create request ---------------- Follow the instructions below, for the system you use.  ### Windows From the command prompt, navigate to where you saved the BankID Keygen (keygen-windows.exe) and start the program.  keygen-windows.exe ### Linux Start a terminal and navigate to where you saved BankID Keygen. Depending on your local environment and permissions you might have to change permissions to run the application. To change permission, use the command chmod.  chmod +x keygen-linux Then start the Keygen program.  ./keygen-linux Enter information ------------------- When you start the Keygen program you will se the Keygen welcome screen:  To generate a CSR, select '1' on the welcome screen and press 'Enter'. The following information is required in the CSR process: **Official name of your organisation** This should be your organisation’s registered company name (max 64 characters). **Corporate identity number of your organisation** Enter your company’s corporate registration number according to Bolagsverket or equivalent without hyphens or spaces (10 digits). **Password to protect your private key** This is your password to protect your private key that will be generated. It must be at least 12 characters long and contain four letters and one digit. You will have to use this password later in the process when creating your PKCS#12. _It's very important that you remember this password as it can't be restored!_ **Display name** This will be shown to the user when they identify themselves or sign to your services. Enter the name to be displayed (max 40 characters) according to the instructions from your bank. The display name is usually the organization's registered company name or the name commonly used for the organization /e-service, e.g. a registered trademark. Before the certificate request is created you will have the option of verifying the information. If all looks good, press Y and enter to create the certificate request. **Private key file** The application will suggest a filename for Private Key file. If you accept it the file will be saved in the working directory. If you want to save it in another place you can manually type the path and file name. Make sure the file extension is still .key. **Certificate request file** The application will suggest a filename for CSR file. If you accept it, the file will be saved in the working directory. If you want to save it in another place you can manually type the path and file name. Make sure it's still .p10. This is the file you need to send to the bank in order to get your certificate. The CSR-generation is finished and you can ensure your request is created and saved on the disc:  Send request -------------- You should now send your certificate request (example: CSR\_Ericsson\_20200323.p10). * If you have an agreement for the BankID service with a bank you are to send your file to them according to their instructions. You should receive the recipient and delivery information from the bank. * Public organisations connecting through "Auktorisationssystem för elektronisk identifiering" should send their file to [auktorisationssystem@bankid.com](mailto:auktorisationssystem@bankid.com). #### Please note * It’s only the **P10 file** you should send. Never the private key file. Receive the issued certificate -------------------------------- Your request is usually handled within three workdays. Once you've received the certificate it's time to [create the PKCS#12 / PFX file](https://developers.bankid.com/getting-started/order-certificate/create-file). Create the PKCS#12 / PFX file ============================= Once you've received the issued certificate from the bank it's time to create a bundle containing the private key and the certificate. This will be used from your application in communication with the our service. The bundle is often referred to as a PKCS#12, P12 or PFX file.  ### Windows From a command prompt, navigate to where you saved BankID Keygen (keygen.exe) and then run the command keygen.exe. ### Linux Depending on your local environment and permissions, you might have to change permissions to run the application. To change permission, write 'chmod-x keygen'. Start a terminal and navigate to where you saved BankID Keygen and then type './keygen'. This will start the welcome screen of BankID Keygen: 1. On the welcome screen, select 3 'Generate PKCS#12 / PFX'_._ 2. BankID Keygen will now show a numbered list of all the files with a .key extension found in the working directory. Select the number in the list corresponding to the private key you want to use and press 'Enter'. You should select the key corresponding to the CSR you previously sent to the bank. If there’s only one key in the directory the number will be 1. 3. You will now be asked to enter the password for the private key. This is the password you set when you created the CSR. Type the password and press 'Enter'. 4. Next, you will be asked for the certificate you've received from the bank. If you've saved the file in the working directory, where keygen is saved, it will be shown in a numbered list. If you've saved it somewhere else you need to manually enter the path to the file. 5. The PKCS#12 output file is the final step where you enter the path to where you want to save the PKCS#12 file. Press 'Enter' to save it in the working directory with a default file name, or manually enter a new file name and path to save the file. BankID on the same device ========================= This page describes a common use case; when the user wants to identify themselves or sign something in your service, using a Mobile BankID on the same device as they visit the service on. Mobile BankID on the same device ---------------------------------- A. The user selects _identify with BankID_ in your app. 1. Your frontend calls your backend to indicate that the user wants to authenticate. 2. Your backend then calls BankID service to create an order. 3. BankID service returns an orderRef and autoStartToken. 4. Your backend passes the autoStartToken to your client. 5. Your frontend starts the BankID app using the autoStartToken. B. The BankID app starts on the user’s device. The user authenticates in the BankID app. C. The BankID app closes and the user is returned to your frontend. D. In the background, your backend uses the Collect method in the BankID service to check order status. Collect should be called every 2 seconds. 1. Once the order is completed, your backend gets the personalNumber used as well as other user specific information. 2. Check that the ipAddress you get back from the /collect matches the IP adress you observe. This is important to ensure session fixation. 3. The user is authenticated in your app. Mobile BankID on another device =============================== This page describes a common use case; when the user wants to identify themselves or sign something in your service, using a Mobile BankID on another device.  A. The user selects _identify with BankID_ on i.e. your website.  1. Your frontend calls your backend to indicate that the user wants to authenticate. 2. Your backend calls BankID service to create an order. 3. BankID service returns an orderRef, qrStartToken and qrStartSecret. 4. Your backend uses the qrStartToken and qrStartSecret as input when generating the QR data.  5. Your frontend gets the QR data from your backend.  6. Your frontend generates and displays the animated QR code to the user. B. The user opens their BankID app, scans the animated QR code and completes the authentication in the BankID app. C. In the background, your backend uses the Collect method in our service to check the order status. Collect should be called every 2 seconds.  1. Once the order is completed your backend revecives the personalNumber used as well as other user specific information. D. The user is authenticated in your app. Verification of digital ID card =============================== This page describes a common use case; when you wish to verify a digital ID card from BankID using our API Verification of digital ID card.  A. The user presents the opened digital ID card (with an animated QR code).  B. The person verifying the ID card scans the presented animated QR code using i.e. a scanner.  C. Your backend request 'Verification of digital ID card from BankID' using BankID Web Service API:s /rp/v1/verify endpoint. D. BankID service verifies the authenticity of the animated QR code and the digital ID card. E. Your backend receives a signed proof-of-identification from the Web Service API. Animated QR codes are meant to be consumed within a short period of time and thus expire after a certain amount of time. If an expired QR code is used, an error is returned, see [Errors page](https://developers.bankid.com/api-references/errors). Read more about the signed proof-of-identification. Fallback ======== There are instances where it can be hard to detect if your app is running on the same device as the BankID app or not. Therefore, it is recommended to have a fallback in the interface when: * BankID is used on the same device, it is recommended to present an animated QR code and the option to “Open BankID on another device.  * Your application and BankID are on different devices and the animated QR code is shown, giving the user an option to “Open on this device” is recommended. Autostart ========= Here you find instructions for how to start the BankID app when it's stored on the same device used to visit your app or webpage. The app is started by using autostart. This is done by using web urls and depending what platform your client is running on, the methods vary slightly. Below we describe the different ways to start the BankID app. For an overview of the most common use cases, see [use cases](https://developers.bankid.com/use-cases/mobile-bankid-on-the-same-device). Parameters ------------ | Parameter | Description | | --- | --- | | autostarttoken | Required Holds the autoStartToken returned from the web service call. | | redirect | OptionalDeprecated. This is replaced by sending the redirect in the backend call when you create the order istead. See API references page for how to send 'returnUrl'.The BankID app uses the parameter redirect to launch your web app after completing (including cancelled) auth or sign.The redirect URL:Must be UTF-8 and URL encoded.Must start with https://Should take the user back to the same webpage.May include parameters to be passed to the browser.Can be set to null.If the redirect URL is set to null, the BankID app will close without launching any URL and the app behind it will be in focus. This is likely to be the calling app.Note:The redirect URL will always be opened in the user's default browser, even if a different browser opened the BankID app.Note iOS:On iOS, Redirect=null means that your web or app won't be launched once the order is completed. | | rpref | OptionalThis is a relying party reference. It isn't supported on mobile devices.It can be any reference you want to use. The value will be included in the resulting signature. A typical use case is to protect a file when it's transported from a client to a server. The value must be base64 encoded, URL encoded, and 8 – 255 bytes (after encoding). | Native app on mobile device ----------------------------- ### iOS If your client is an iOS app you should start the BankID app by using a univeral link. let url = URL(string: "https://app.bankid.com/?autostarttoken=[TOKEN]") UIApplication.shared.open(url!, options: [.universalLinksOnly:true]) { (success) in // handle success/failure } If the BankID app isn’t present on the user's device, the answer ‘false’ is returned. In that case you need to inform the user that they need to install the BankID app and get a BankID. Your app must register a universal link or a custom URL scheme to make it possible for the BankID app to re-launch your app. The Apple App Store review process requires login information to a demo account for the app to be approved. This can be a demo account that doesn’t require a BankID to login, or a way to configure the app to use the BankID test environment. ### Android If your client is an Android app you should start the BankID app by using a url.  class MyActivity : AppCompatActivity() { // The calling app should not rely on the value of the result, or on // the result to be returned at any particular time. private val launcher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { } ... val intent = Intent().apply { action = Intent.ACTION_VIEW data = Uri.parse("https://app.bankid.com/?autostarttoken=[TOKEN]&redirect=null") } launcher.launch(intent) If the BankID app isn’t present on the user's device, an android.content.ActivityNotFoundException is thrown. In that case you need to inform the user that they need to install the BankID app and get a BankID.  A valid result isn't guaranteed to be returned from the BankID app to your own app's activity. Your app should rely on the collect call to get the result of the auth or sign order. Launching from a browser -------------------------- If your frontend is a web page you should start the BankID app using a web link url. You need to check if the user's browser is running on a mobile or a desktop device.  ### Mobile device To open the Mobile BankID app from a browser on a mobile device, you should use unversal links for iOS and app links for Android. They are opened with the following syntax: const link = document.createElement("a") link.href="https://app.bankid.com/?autostarttoken=[TOKEN]" link.referrerPolicy="origin" link.click() ### Desktop The URL works on PCs with all commonly used browsers. Variations exist on different platforms. The syntax is:   bankid:///?autostarttoken=[TOKEN] QR code ------- Animated QR codes are used with BankID when the user visits your service on one device, i.e. a computer, but use BankID on another device, i.e. their mobile. The flow is:   1. Your service generates a QR code. 2. Your service presents the QR code to the user.   3. The user scans the QR code using their BankID app.   If successful, the BankID app will proceed with the order.  [View an overview](https://developers.bankid.com/use-cases/mobile-bankid-on-another-device) Animation and timings ----------------------- To increase security, animated QR codes are used. This means that your service updates the QR code continuously, thereby making remote fraud more difficult.   * Your service should update the QR code every second.   * The codes should be generated continuously, not in advance since pre-generation would lower security.   * The order to our server is valid for 30 seconds, meaning the user must scan the QR code within this time limit. To give a longer display time you can create new orders, for example for five minutes. * If the user approaches a time-out, you should provide the user with an option to extend the session. If the time is extended, a new order must be created.  Accessibility --------------- Since July 2025, stronger requirements regarding accessibility must be fulfilled to meet legal demands. Amongst other things, these will affect the two-device flow for BankID where the animated QR code is used. Read about the [legal requirements](https://www.w3.org/WAI/WCAG21/Understanding/timing-adjustable.html), and please consider the tips below.  * The QR code should be a element.  * Pressing the QR code should open the QR code in fullscreen mode.  * Add an Alt text to inform about that it’s a QR code and that its clickable.  * Ensure that any sticky elements don't prevent mouse interaction with the QR code and other elements. Whilst not a requirement, making the QR code sticky is a common suggestion for accessibility. However, it might result in important content being covered and you need to decide what works best for your service. Another good practise is to never invert the colours of the QR code as it may make scanning more difficult.  Below you find more information on how to handle different topics:  Countdown timer and extend button The QR code should have a countdown timer and an extend button. The order to our server is valid for 30 seconds.  * To give a longer display time you can create new orders, i.e. for five minutes.  * When the countdown timer reaches 30 seconds, display an extend button. * You should disable screen readers from reading the countdown timer and instead have a screen reader only element with aria-live that reads out the countdown timer at key intervals such as: * 5, 4, 3, 2, 1 minutes remaining  * 50, 40, 30, 20, 10 seconds remaining If the time is extended by the user, the timer should reset to 5 minutes remaining again.  * Extending the time should be done with "space bar" or by pressing the extend button regardless of focus.  * Pressing the extend button should focus the client back to the QR code button. * Use tabIndex="-1" and javascript to focus on the main message of the flow state, e.g. "Identify with BankID" or "Failed to scan the QR Code" when transaction state changes.  Fullscreen * Ensure that the scrolling function isn’t blocked.  * Pressing the QR code in fullscreen mode should exit the fullscreen mode. * When exiting or entering fullscreen mode, focus on the extend button if it’s displayed, otherwise focus on the QR code button.  Zoom and scale A visually impaired user might be zoomed in to the maximum to be able to read the content. Make sure that:  * The QR code is not too large or small.  * The QR code is still visible and not cut off up to 200% zoom.  * Important content isn’t covered by the QR code.  Small or large window * Small window: A screen reader user might have a non-maximized browser window and might not see the QR code. Visually impaired users should have easy access to options for ensuring that the QR code is visible e.g. fullscreen mode. * Large window: Ensure that the QR code is visible and not cut off.  ### Live example You can see our example live on our test site for end-users. Open the link and select ‘Start the test’.  Even if you don’t have a production BankID, you can still view the solution . There’s no need to execute the test.  [To the site](https://test.bankid.com/) QR code generation -------------------- The QR codes are generated on your end. There are many third-party tools and libraries available on the market for this. For generation, use the pattern "bankid.qrStartToken.time.qrAuthCode" as link in the QR code, where:  * bankid is a fixed prefix.  * qrStartToken is from the auth or sign response.  * time is the number of seconds since the order was created.  * qrAuthCode is computed as HMACSHA256(qrStartSecret, time) where time is the number of seconds since the response from auth or sign was returned and qrStartSecret is from the auth or sign response.  **Note:** The qrStartSecret shouldn’t be sent to your frontend. It’s a secret to be shared by BankID service and your backend only.  ### Tips and recommendations * The code is supposed to be read from a screen. Therefore, the ‘QR code error correction level’ can be low.  * Colours in the QR code should be kept to a minimum, we recommend that you use black.  * Never invert the colours as it may make scanning more difficult. Keep this is mind for dark mode settings too.  * Allow for some margin to enhance contrast.   * Avoid including other information or graphics in the QR code, e.g. layered logotypes.   If the QR code is too old, you must initiate a new request and the user must try again. ### Example If the qrStartToken is 67df3917-fa0d-44e5-b327-edcc928297f8 and the and qrStartSecret is d28db9a7-4cde-429e-a983-359be676944c, the following urls and times will be generated:   | Time | QR data | QR | | --- | --- | --- | | t=0 | bankid.67df3917-fa0d-44e5-b327-edcc928297f8.0.dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8 | | | t=1 | bankid.67df3917-fa0d-44e5-b327-edcc928297f8.1.949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2 | | | t=2 | bankid.67df3917-fa0d-44e5-b327-edcc928297f8.2.a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3 | | Sample code ------------- The sample code provides a detailed description of how to compute the QR codes for some coding languages.   ### Python import hashlib import hmac import time qr_start_token = rp_response["qrStartToken"] # "67df3917-fa0d-44e5-b327-edcc928297f8" qr_start_secret = rp_response["qrStartSecret"] # "d28db9a7-4cde-429e-a983-359be676944c" order_time = time.time() # (The time in seconds when the response from the BankID service was delivered) qr_time = str(int(time.time() - order_time)) # ("0" or another string with a higher number depending on order_time and current time) qr_auth_code = hmac.new(qr_start_secret.encode(), qr_time.encode(), hashlib.sha256).hexdigest() # "dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") # "949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") # "a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") # (64 chars hex) qr_data = str.join(".", ["bankid", qr_start_token, qr_time, qr_auth_code]) # "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.0.dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") # "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.1.949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") # "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.2.a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") ### Java import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import java.math.BigInteger; import java.time.temporal.ChronoUnit; String qrStartToken = rpResponse.getQrStartToken(); // "67df3917-fa0d-44e5-b327-edcc928297f8" String qrStartSecret = rpResponse.getQrStartSecret(); // "d28db9a7-4cde-429e-a983-359be676944c" String qrTime = Long.toString(orderTime.until(Instant.now(), ChronoUnit.SECONDS)); // ("0" or another string with a higher number depending on order time and current time) Mac mac = Mac.getInstance("HmacSHA256"); mac.init(new SecretKeySpec(qrStartSecret.getBytes(StandardCharsets.US_ASCII), "HmacSHA256")); mac.update(qrTime.getBytes(StandardCharsets.US_ASCII)); String qrAuthCode = String.format("%064x", new BigInteger(1, mac.doFinal())); // "dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") // "949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") // "a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") // (64 chars hex) String qrData = String.join(".", "bankid", qrStartToken, qrTime, qrAuthCode) // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.0.dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.1.949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.2.a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") ### Javascript import crypto from 'crypto'; const qrStartToken = rpResponse.qrStartToken; // "67df3917-fa0d-44e5-b327-edcc928297f8" const qrStartSecret = rpResponse.qrStartSecret; // "d28db9a7-4cde-429e-a983-359be676944c" const orderTime = Date.now() / 1000; // (The time in seconds when the response from the BankID service was delivered) const qrTime = Math.floor(Date.now() / 1000 - orderTime).toString(); // ("0" or another string with a higher number depending on orderTime and current time) const qrAuthCode = crypto.createHmac('sha256', qrStartSecret).update(qrTime).digest('hex'); // "dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") // "949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") // "a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") // (64 chars hex) const qrData = ['bankid', qrStartToken, qrTime, qrAuthCode].join('.'); // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.0.dc69358e712458a66a7525beef148ae8526b1c71610eff2c16cdffb4cdac9bf8" (qr_time="0") // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.1.949d559bf23403952a94d103e67743126381eda00f0b3cbddbf7c96b1adcbce2" (qr_time="1") // "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.2.a9e5ec59cb4eee4ef4117150abc58fad7a85439a6a96ccbecc3668b41795b3f3" (qr_time="2") Return URL ========== When the BankID client is used on the same device as the user visits your service on, the user should be sent back to your service once they've completed their action in the BankID client. From version 6 of our RP-API, it's possible and strongly recommended to send the return URL via server, meaning that you can protect the user and ensure that any sessions started from your service will send them back to your service. This can mitigate some session fixation cases. Note that usage of return URL as part of autostart URL is deprecated. Instead, the return URL should be included in the RP-API call when starting an order.  How it works -------------- ### For web 1. The user visits your website at https://www.example.com  2. The user chooses to log in. https://www.example.com/login   3. Your website makes a call to our RP-API which includes, among other things, the return URL: https://www.example.com/login#nonce=\[session nonce\]     4. The RP-API returns the autostart token.  5. Your website starts the BankID client using the autostart URL. Example: https://app.bankid.com/?autostarttoken=\[autostarttoken from step 4\]  6. The user completes the identification in the BankID app.  7. The BankID app invokes the return URL, previously sent to the RP-API in step 3.  8. Your website verifies that the nonce matches the session nonce. ### For app 1. The user starts your app.  2. The user chooses to log in.    3. Your app makes a server side call to our RP-API, which includes, among other things, the app specific return URL: https://app.example.com/login#nonce=\[session nonce\] or myapp://login#nonce=\[session nonce\].  4. The RP-API returns the autostart token.  5. Your app starts the BankID client using the autostart URL. Example: https://app.bankid.com/?autostarttoken=\[autostarttoken from step 4\]  6. The user completes the identification in the BankID app.  7. The BankID app invokes the return URL, previously sent to the RP-API in step 3.  8. Your app verifies that the nonce matches the session nonce. **Please note:** If the user has an older desktop version of the BankID client that doesn't support getting the return URL from the server, the order will be cancelled and the user will be asked to update their app.  Pitfalls in web flows ----------------------- In cases where the user visits your service in a web browser you can face some challenges when it comes to returning them to the right broswser or app. This is due to device settings and/or differences in browser behaviour and is out of our control. However, there are some things you can do to enhance the probability that the user is returned to the right browser and/or tab.  ### Returning the user to correct browser The return URL will be opened in the default browser, even if the user started the session in a different browser. If the used brower has a documented URL scheme this should be used in the return URL instead of 'https'.  **Example**: https://www.example.com/ for Google Chrome would be: chromebrowser://www.example.com/.  **Please note**: For browser without a documented URL scheme, the user will be sent to the default browser.  ### Returning the user to correct tab For a good user experience, returning the user to the same tab is preferred. However, it can be a challenge to do this from an app, such as BankID security app. The highest probability to return the user to the tab where they started BankID from, is to use the exact URL of the target tab as the return URL. However, to bind the new request to the old browser session, the return URL should include a nonce that server side will match to the old browser session. The best way to accomplish this is to place the nonce in the URL fragment. Please note that the nonce should not contain sensitive session information such as the session cookie. **Example**: https://www.example.com/login#nonce=\[session nonce\] ### Returning the user to correct browser and tab When combining the methods above, some browsers may deliver unexpected results. This is because different browser behave differently when given the same input. It's important that you test different scenarios for your service. Verifying signatures ==================== The information on this topic differs between the APIs we offer. Please navigate to the section below that is relevant to your situation:  * [Auth & Sign](https://developers.bankid.com/how-to-guides/verifying-signatures) * [Verification of digital ID card](https://developers.bankid.com/how-to-guides/verifying-signatures)  For information about certificates in our services we recommend you to read the [Environments page](https://developers.bankid.com/getting-started/environments).  Auth and sign --------------- All signatures that are returned from the service are verified, including the certificates. Therefore, you don’t need to verify them. However, it's possible to verify them if you'd like to. To verify a signature the following is needed:  * The signature returned from the service. A specification of the content is delivered upon request.  * The certificate of the user and intermediate CAs. These are included in the signature.  * The ocspResponse returned from the service.  * The self-signed root certificate. This is delivered upon request.  **How to verify:** 1. Verify certificate of the ocspResponse signer, starting with the certificate directly issued by a trusted issuer. 2. Verify the signature on the OCSP response.  3. Verify the status in the OCSP response.  4. Verify certificates, starting with the one directly issued by our self-signed root certificate.  5. Verify that the user certificate is issued by the same CA as the certificate of the ocspResponse signer.  6. Verify that OCSP nonce matches with digest of signature. 7. Verify signature.  Please note that our service doesn’t save the data in the signature. You are responsible for saving the data you need, in accordance to applicable regulations and laws.  Verification of digital ID card --------------------------------- The BankID service verify all signatures, including the certificates. Therefore, you don’t need to verify them.  ### Proof of identification format For each successfull verification a proof of identification is provided. This is in the format of an XAdES-signed XML document. The digital signature conforms to XAdES ETSI TS 103 171 v2.1.1 Baseline Profile B-B.  [Read more about XAdES ](https://www.etsi.org/deliver/etsi_ts/103100_103199/103171/02.01.01_60/ts_103171v020101p.pdf)   The signature is an enveloping signature and uses XML-C14N for XML canonicalization.  [Read more about XML-C14N](http://www.w3.org/2001/10/xml-exc-c14n) ### Content The following signed information is included in the signature:   #### bankIDSignedData The element is the root signed element, which contains a textual identifier for the type of transaction, as well as two timestamps.  | Name | Type | Description | | --- | --- | --- | | verificationId | xs:string | A UUID identifier for the performed verification. | | orderRef | xs:string | Identifier for the transaction used when an end user identifies themselves with BankID. | | transactionType | xs:string | Identifies the type of transaction. This is always "ID-kort-validering". | | identifiedAt | xs:datetime | Date and time when the end-user identified themselves with BankID. Formatted according to RFC3339 in UTC. | | verifiedAt | xs:datetime | Date and time when your service verified the animated QR code presented by the end user. Formatted according to RFC3339 in UTC. | #### Example ID-kort-validering 2022-10-04T09:04:37Z 2022-10-04T09:05:49Z #### relyingParty The element conveys information about you when you request the Verification of digital ID card from BankID. | Name | Type | Description | | --- | --- | --- | | displayName | xs:string | The name of your organisation according to the "DisplayName" extension encoded in your certificate. | | commonName | xs:string | The Subject CommonName according to your certificate. | | certificateSerial | xs:string | Your certificate serial number. | #### Example FID Test fid 1 #### endUser The element contains data describing the end user presenting the QR code that is scanned by your service.  | Name | Type | Description | | --- | --- | --- | | personalNumber | xs:string | The personal identity number, or other identifier, of the individual presenting the verified animated QR code. | | firstName | xs:string | First name of the verified individual. | | lastName | xs:string | Last name of the verified individual. | | age | xs:int | Age of the end user at the moment of verification. | #### Example 191212121212 Tolvan Tolvansson 110 Signed example ---------------- Note that the example signature document has been formatted and truncated for brevity. The real signature will be canonical XML, including removal of line breaks between elements et cetera. The truncation and formatting in this example means that the digest over the #signedData element is incorrect.  +B5H8GVLQ73O4AMZ9RLtGk26NJFphhsOUs4BEV70nm8= u/Sk0p7gboARsAYPlDxdeEccj4SonWmVutV6k59YGPY= S75Nj4S3u7w0mms4HnhE/7TbLEiKLthw0qv869hLBZziKiQ+BlWhED0067sD3OYenqTbg9Ik8cl2uGcA3b51vi9CrRnh52gCVUWzg1CQTMBGBk7HDScZbvGvxRJL8uqL6mGgSNrSKbcS2iLTggDpjhEq+myW5MZhl6G7hWsGgBa5ETbC/mGjlbmmd+zNi2b9VMJENutuvKkFUwkvnyvqAULvRJOX8MaplF9JunPSf09eBaM8JEBYd7e2m6sdv+l0Z0YIoHJ3xqOAzKX7waU/2Mm/b953G49UeY0N68rT3j34oQxEQ5wDNoz3HZios46OKqFvfQpfv0dGaSndGwTQqw== MIIEPTCCAqWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBgMQswCQYDVQQGEwJTRTEUMBIGA1UEChMLVEVTVCBDQSBPUkcxGTAXBgNVBAsTEFRFU1QgQ0EgT1JHIFVOSVQxIDAeBgNVBAMTF3Rlc3QgYW5kIGRldmVsb3BtZW50IENBMB4XDTIzMDIyMjEzNDMyM1oXDTIzMDgyMTEzNDMyM1owbDEnMCUGA1UEChMebWtjZXJ0IGRldmVsb3BtZW50IGNlcnRpZmljYXRlMRIwEAYDVQQDEwlsb2NhbGhvc3QxLTArBgNVBAUTJDM4ODU4YTFiLTZhZTUtNDRmMy1hNzFjLTkzNDAzN2Y1YjQxNzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMD3Z9FWQ0YrP2ZJKgnez+xeEdcRHbnvjJpTcGo/hjHt5JGVKGBX9MwTNUGW9ueByotdvSGtggsXjGoB+yT0Qll12V7crEmsOsq+JldUE8uMPJOdwfc2VykKkGIWuW8pEc+EsedSm4Jd4Tdy4MlKDJaWvL4wyHHQqaO9DVUHtaP/RArt/Ca2azY/dcZ9Zc8OoWbFUMA4UdEs/98xlwnf9mwqXzfd2K+ne4zvLLKACbhENVzibpYr6NZCG83yDBC4B71UhKl+4+Ju9smqU86rG/+OtLVjkxSBdFPbOg749TyPyI97ZB12g3NZJjLHZntfOtOdp81HZqmftSiunhtx5pkCAwEAAaN2MHQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFAIpjX4K082uc6f2aCcpk/cK6ETLMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAYEAOabde+w7zz8qY5v9pBDgfgf1Os5ToVVqfh58h6DF/dDLFOJCZ0tvO/nH7RTYWhvYID3f0rhcNO92PqsTrpytSwreqQWL9uLatVGfG/bOOewAV3MtpdKR5DB3PsA8IPQHmv3NJEiojfxo9vMEHaChoGCTrkUZegUR/CClpYW2BhnHDx4/mgWAzjyPN6Weaee+YolulL6RowO+S1YNo5eP+tIzRlAp9+Lyl7EhWuylccyVkTCVwSBVerN1nSblpuboA7oKBV3gsMMnq7XFxHj0mqQosswqUMMiCYh1Mw7PIRJuSBcIjNZQ/lvbs2IQOqGP0eIxbnQfuv2OHgnaIFUNKN8kgbgrCq8fmhbmz7CJoDt4rUDcxbd/tSQ4p6Swk66aBceWlYXs8QsXWTFwzrHC+WzSSFLgOQmp1rP5yHvPPC1YN1qrPnT/5o9rVmj8IsJ7Xs/i6T4AOGbSEClH2hLke2FSu/+Q9rtvAKiuvdftt92u5LAvQgDXTbNDKRoohxgT 2023-02-22T14:43:23Z 08rujjUVTfgLNdc2ARAYlaSD0Q0VjNR1E0uy6IGyO0M= CN=test and development CA,OU=TEST CA ORG UNIT,O=TEST CA ORG,C=SE 1 text/xml aee13518-672f-4d06-8db2-5cdfcb187114 b96a8b7e-7d2e-4fa8-bb84-2765d6dd499e ID-kort-validering 191212121212 Tolvan Tolvansson 110 TestRP A Test förlitande part A 5512341234 2023-02-22T13:43:23Z 2023-02-22T13:43:23Z Risk indication =============== The purpose of risk indication is to protect against situations where usage is initiated by a scammer in one technical environment and later completed by the real user in another.  A risk indication can be requested by adding the parameter returnRisk to your request, along with some information. Based on the provided information and some other parameters, several extra security checks are be executed and a value is computed and returned to your service.  Information to include ---------------------- The following information can be sent with the request: • End user’s IP address • Launch type: web or app • Domain/package name • User agent/HW/OS • Web cookie/AppHWID Three levels of risk -------------------- The risk indication can result in the values low, medium or high. Details about the checks can’t be shared due to protection of user privacy as well as for security reasons. In short, the values can be described as follows:  **Low:** We find no signs of misuse based on the checks carried out. We always recommend that your service makes its own risk assessment and weighs the risk indication in the overall assessment. If your service sees no other signs of increased risk, it should be safe to continue with the order. **Medium:** We find signs that may indicate misuse, but not enough to strongly recommend the order to be cancelled. The service should assess the consequences of misuse from a business and customer perspective. If the consequences can be high, cancelling should be considered. There is also the option to ask the user to confirm their identity an extra time with an [Extra control](https://developers.bankid.com/how-to-guides/extra-control). **High:** Risk indication finds significant signs of misuse, and we recommend that the order is cancelled. Combine with other security measures ------------------------------------ The risk indication from us should be seen as a complement to the overall security measures taken. How your company, or the authority you represent, should act on the indication also depends on other information from your own risk analyzes and the nature of the situation. Handling sensitive information or money transfers often requires greater caution than, for example, an appointment booking service.  Example, launch type app ------------------------ { "endUserIp": "192.168.1.2", "returnUrl": "https://bankid.com/auth/login_page#nonce=a3618c72-bc71-4002-b3de-509555b175db", "userVisibleData": "IFRoaXMgaXMgYSBzYW1wbGUgdGV4dCB0byBiZSBzaWduZWQ=", "returnRisk": true, "app": { "appIdentifier": "com.imadethisup", "deviceOS": "IOS 16.7.7", "deviceModelName": "Apple iPhone14,3", "deviceIdentifier": "f1e3813ab36f114d4b0c2b3636617511467adb353ce8e5ae6c83500d932f2269" } } Extra control ============= Your service can request an enhancement in the form of an extra control of the user’s identity for selected orders. It could, for example, be used in cases that are more sensitive or of higher risk than normal, such as performing an unusually high monetary transaction or getting access to sensitive information.  How it works ------------ 1\. The user visits your service.   2\. The user chooses to identify or sign with BankID.  3\. Your service makes a call to our RP-API and includes the requirement ‘mrtd’.  4\. The user is asked to confirm their identity with their Swedish passport or national ID card.   5\. The user performs the extra control using their ID document.  6\. The user identifies themselves in the app using their security code or biometrics.  7\. Your service receives a proof of identification or signature, stating the order included an enhancement, in this case the extra control.  ### Only when requested The default is to not ask for the extra control. It will only be prompted if you send in the mrtd requirement with your call.  When to use ----------- The requirement mrtd is available for the following endpoints:  * [/auth](https://developers.bankid.com/api-references/auth--sign/auth)  * [/sign](https://developers.bankid.com/api-references/auth--sign/sign) * [/phone/auth](https://developers.bankid.com/api-references/auth--sign/phone-auth)  * [/phone/sign](https://developers.bankid.com/api-references/auth--sign/phone-sign)  * [/payment](https://developers.bankid.com/api-references/auth--sign/payment)  ### Use with care The user will need their physical ID document at hand. Since not all types if ID documents can be used, it’s likely that users will not have the required document at hand at all times. Though this can be a great extra security measure, it should be used with care to avoid unwanted friction. Our recommendation is to specify when it’s relevant in your service and only use it in those situations. Payment warnings and risk flags =============================== These warnings can be used within the /payments endpoints only.  An option to show warnings to the enduser in a payment situation is now available. The warnings are pre-defined and you choose when and if to use them. The purpose is to help the user detect if something isn't right. Please consider banner blindness, if warnings are constantly shown they will soon loose their power.  The available values for warnings and the text displayed to the user are shown below.      | Value | Text shown to user | | --- | --- | | newRecipient | New recipient | | largeAmount | Large amount | | foreignCurrency | Foreign currency | | cryptoCurrencyPurchase | Purchase of crypto currency | | moneyTransfer | Money transfer | | overseasTransaction | International payment | | recurringPayment | Recurring payment | | partialNameMatch | IBAN and name don’t fully match | | noNameMatch | IBAN and name don’t match | | other | Please verify the details above | One warning per payment only ---------------------------- There is only room for one visible warning per payment, so you need to prioritise. How you use the warnings is likely to depend on your business needs and your user's behaviour. It is recommended to set up a logic on your side for:  * Which warnings you use.  * When these are triggered.  * How warnings are prioritised in the event of several warnings being triggered for the same payment.  Bulk payments can also contain one warning per payment.  Information on warnings not saved --------------------------------- We don’t save information about warnings used. If you need to store the information this must be done on your end.   Risk flags - for future use --------------------------- There is a possibility to add warnings that arn't displayed in the UI, then called risk flags. The purpose is to indicate to our risk assessment system that the payment has a higher risk or is unusual for the user. This functionality isn't yet used, but is added for planned future functionality. You can already add these to have them in place for later, but they won't make a difference just yet.  The possible values are the same as for the visible warnings. You can attach as many riskflags as you want to each payment.  Technical details ----------------- The details on how to use the warnings and risk flags are found in the API references for the different payment endpoints:  [/payment](https://developers.bankid.com/api-references/auth--sign/payment) [/payment/bulk](https://developers.bankid.com/api-references/auth--sign/payment/bulk) [/phone/payment](https://developers.bankid.com/api-references/auth--sign/phone/payment) [/phone/payment/bulk](https://developers.bankid.com/api-references/auth--sign/phone/payment/bulk) Formatting text =============== To make the user more aware of what they are signing or the intention of an identification, it's possible to add descriptive text that are shown to the user in the BanKID app. You can also apply formatting to the text you add. This is achieved by: * using the parameter userVisibleDataFormat in the call to /auth or /sign. * using the syntax and special characters specified in this guide in userVisibleData.  You can [test your formatted text in our Test portal](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) Parameters ========== The optional parameter 'userVisibleDataFormat', has been introduced for both /sign and /auth to indicate that userVisibleData holds formatting characters. If you want to use more than the default formatting capabilities, userVisibleDataFormat must be set to “simpleMarkdownV1”. { "endUserIp": "194.168.2.25", "userVisibleData": "IFRoaXMgaXMgYSBzYW1wbGUgdGV4dCB0byBiZSBzaWduZWQ=", "userVisibleDataFormat": "simpleMarkdownV1" } If userVisibleDataFormat is used, the resulting XML signature will hold the new attribute format="simpleMarkdownV1" to denote that formatting was applied before the information was displayed to the user. However, the element userVisibleData in the resulting XML signature will always hold the exact information received from your service, regardless of how it was rendered in the client.  Test your text -------------- You can [test your formatted text in our Test portal](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) Syntax, special characters and rendering ======================================== | Topic | Description | | --- | --- | | Encoding and valid characters | The encoding must be UTF-8. In this guide, characters are referred to by their Unicode code-points when necessary.Valid characters are:U+0020 to U+007EU+00A0 to U+FFEF as well as U+000A (Newline)U+0009 (Tab)U+000D (Carriage return) | | Definitions | Whitespace character: space (U+0020) or tab (U+0009).Whitespace: A sequence of one or more whitespace characters. A sequence of whitespace characters are rendered as one single space character. Initial and ending whitespace is truncated.Note: In some versions of the BankID client, a single whitespace character ending a row after bold text will generate an error. Therefore, avoid trailing spaces.Space: One U+0020 character.Line ending: Newline (U+000A), Carriage return (U+000D) or Carriage return followed by Newline.Line: A sequence of zero or more characters, not being Newline (U+000A) or Carriage return (U+000D), followed by Line ending or end of document. | | Escaping | Some characters can be escaped by prepending '\'. They are #, +, |, *, - and \.Prepending '\' to any other character is invalid.Escaped characters are rendered as text. The prepended '\' is not rendered.Characters that can be escaped is treated as text where they have no syntactic significance:'#', '-' and '+' have syntactic significance only when they are the first character of a line.'|' has syntactic significance only when it is the first character of a line, or when appearing on a line where the first character is '|'.'*' has syntactic significance in text flows.'\' always has syntactic significance. | | Inline formatting | All text supports inline formatting. All formatting that isn't inline in text is identified by an initial token on the relevant line. If the rest of the line doesn't adhere to the syntax for the relevant formatting type, the document is invalid. | | Headings | Initial token: One to three '#' characters. A heading is defined as a line starting with one to three '#' characters, a space followed by the heading text. If the heading text is absent or only whitespace, the document is invalid. The level of the heading is equal to the number of initial '#' characters. | | Thematic break | Initial token: '---'Thematic break is defined as a line equal to '---', optionally followed by whitespace. | | Tables | A table is a head row, a delimiter row and zero or more table data rows. A table with more than 5 columns renders the document invalid. All rows in a table must have the same amount of cells.Table rowInitial token: '|'Every table row is a line that starts and ends with a pipe character '|'. Between them are table cells separated by pipe characters.Note: In some versions of the BankID client, whitespace character adjacent to pipe will generate an error. Don't include initial or trailing white space in cells. However, omitting whitespace in the signing text here isn't a problem since leading and trailing spaces are added automatically in the output.The cell contents are text for the head row and table data rows. Tables will scale to the width of the phone. This means that text size will decrease for wider tables. Avoid using too much text in table cells. Text in the head row will use strong emphasis by default.Note: In some versions of the BankID client, both plain text and bold text in a cell will generate an error. A single cell can contain text that is either plain or bold, not both.Delimiter rowAll the cells in the delimiter row must contain one or more consecutive '-' characters. Colon ':' can be used on either or both sides of the '-' sequence. A colon to the left defines that column as left-aligned, to the right defines it as right- aligned, and on both sides defines it as centered. Columns are left-aligned by default. No other visible text is allowed in the delimiter row, but whitespace is allowed between '|' and ':' as well as between '|' and '-'. | | Lists | Start token for an unsorted list is '+'.Start token for a sorted list is '+' followed by a sequence of one or two digits, evaluates to zero or a positive integer.A list consists of one or more list items. A list item is defined by a line starting with the initial token followed by a space followed by the list item text.In sorted lists, all numbers are significant, in contrast to several other common code marking variants. This means that you can have list numbers that are duplicates, gaps in numbering, and so on.Leading redundant zeros in numbering aren't allowed. If the text in a list item is missing or contains only spaces, the document is invalid. | | Empty lines | Empty lines are valid, but not rendered. Empty lines are syntactically significant as separator between two tables or two lists of the same type. | | Paragraphs | A line that isn't a heading, thematic break, table row, list item or empty line is a paragraph. All content in a paragraph is treated as text. A paragraph is ended by a line ending or end of document. | | Strong emphasis | The start and end of a section with strong emphasis is defined by '*'.The starting '*' can't be followed by whitespace and the ending '*' can't be preceded by whitespace. As an example, * fat cat*, *fat cat * and * fat cat * aren't permitted.If a section with strong emphasis is not properly ended, the document is invalid. | Test your text -------------- You can [test your formatted text in our Test portal](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) UI guide for mobile browser =========================== This page shows UI tips and best practices, focusing on the flow where the user is browsing on their phone or tablet, and use a Mobile BankID either on the same or on another device.  The examples use the flow for identification (/auth), but the principles can be applied to other flows as well.  Selecting identification method ------------------------------- The first step is usually to select identification method. BankID might be the only choice, or one of several choices.  **1\. Provide a way for users to exit the flow.** This should be easy for the user to find and understand.  **2\. Use of our logo and trademark "BankID" must adhere to guidelines.** Here you find our [branding guidelines](https://www.bankid.com/en/om-oss/varumaerke/varumaerket-bankid).  BankID on same device --------------------- Most commonly, the user will have their Mobile BankID on the same device and this can be the default option. However, some user may browse on one device, i.e. a tablet, and use a Mobile BankID on their phone. Therefore an option to switch to 'other device' should be presented.   **3\. Provide a way to go back.** It's good practice to allow the user to go back to the previous step, when feasible.  **4\. Promt user to open BankID.** The BankID app should be opened automatically using [autostart](https://developers.bankid.com/how-to-guides/autostart). However, in case this fails for some reason, the user should be asked to open the app manually.  **5\. Provide the option to open BankID on another device.** Some users have BankID stored on a different mobile device. The option to use another device should be presented. A common case is when the e-service is visited on a tablet and the BankID is stored on a phone.  BankID on another device ------------------------ If the user has their BankID on a different device, they should be presented with an animated QR code to scan with their BankID app. Read more on the [QR code page](https://developers.bankid.com/how-to-guides/qr-code). **6\. Provide a way to go back.** It's good practice to allow the user to go back to the previous step, when feasible.  **7\. Make sure the QR code is rendered for accessibility**. With new legislation coming into force July 2025, there is much to consider when it comes to accessibility. Read more on the [QR code page](https://developers.bankid.com/how-to-guides/qr-code).  **8\. Let the user know how much time is remaining**. Show a timer that lets the user know the remaining time. Sceenreader usage should also be considered.   **9\. Provide helpful instructions.** Some users may need additional help with how to scan a QR code. Provide this for those who want it.  **10\. Provide the option to open BankID on same device.** The option to change (perhaps back to) BankID on the same device should be presented.  Authorization screen -------------------- The next step takes place in the BankID app. On the screen in the app you can add your own [descriptive text](https://developers.bankid.com/how-to-guides/formatting-text/overview) explaining to the user what the intent of the identification is.  **11\. Add descriptive text.** A helpful [text describing](https://developers.bankid.com/how-to-guides/formatting-text/overview) to describe the intent to the user. The text can be formatted. [Use our tool](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) to see what you text will look like.  Handling contingencies ---------------------- Sometimes things go wrong. Let the user know what happened and help them, best you can, to overcome the problem.  **12\. Let the user know what went wrong and what they can do.** Use [recommended user messages](https://developers.bankid.com/ui-resources/user-messages).  **13\. Provide options for next step.** Help the user to try again, or cancel. UI guide for desktop browser ---------------------------- This page shows some UI best pratices for when the user is browsing on a desktop and use their Mobile BankID on their phone. These examples are for the identification flow, but the main principles are the same for other flows as well.  Selecting identification method ------------------------------- The first step is usually that the user decides how to identify themselves, where BankID might be the only option or one out of several.  **1\. Provide a way for users to exit the flow.** This should be easy for the user to find and understand.  **2\. Use of our logo and trademark "BankID" must adhere to guidelines.** Here you find our [branding guidelines](https://www.bankid.com/en/om-oss/varumaerke/varumaerket-bankid).  Presenting the QR code ---------------------- Since the user's Mobile BankID is on another device you need to present an animated QR code that the user scans with their BankID app. From July 2025 new accessibility legislation will affect the way the QR code should be presented. You'll find more information on the [QR code page](https://developers.bankid.com/how-to-guides/qr-code). **3\. Provide a way to go back.** It's good practice to allow the user to go back to the previous step, when feasible.  **4\. Make sure the QR code is rendered for accessibility.** With new legislation coming into force July 2025, there's much to consider when it comes to accessibility. Read more on the [QR code page](https://developers.bankid.com/how-to-guides/qr-code).  **5\. Let the user know how much time is remaining.** Show a timer that lets the user know the remaining time. Screenreader usage should also be considered.   **6\. Provide helpful instructions.** Some users may need more help with how to scan a QR code. We suggest you provide this for those who want it, but in a way that doesn't obstruct users who don't need it.  **7\. Provide the option to open BankID on same device.** Some users have BankID stored on file or card, and would therefore need to use the desktop client. The majority use Mobile BankID, and therefore a default to the flow for another device is justified. However, the option to change should be presented.  After scanning -------------- Once the QR code has been successfully scanned, the user needs to complete the order in their BankID app using their security code or, if allowed, biometrics.  **8\. Inform the user that action is required in the BankID app.** Whilst most users never see this, it should be there for those who miss the confirmation step in the app.  Handling contingencies ---------------------- Sometimes things go wrong. Let the user know what happened and help them, best you can, to overcome the problem.  **9\. Let the user know what went wrong and what they can do.** Use [recommended user messages](https://developers.bankid.com/ui-resources/user-messages).  **10\. Provide options for next step.** Help the user to try again, or cancel. Recommended user messages ------------------------- | Short name | Swedish | English | | --- | --- | --- | | RFA1 | Starta BankID-appen. | Start your BankID app. | | RFA2 | Du verkar inte ha BankID-appen. Installera den och skaffa ett BankID. | You don't seem to have the BankID app. Install the app and get a BankID. | | RFA3 | Åtgärden avbröts. Försök igen. | The action was cancelled. Please try again. | | RFA4 | En identifiering eller underskrift pågår redan för ditt personnummer. Försök igen. | An identification or signature is already in progress for your personal identity number. Please try again. | | RFA5 | Något gick fel. Försök igen. | Something went wrong. Please try again. | | RFA6 | Åtgärden avbröts. | The action was cancelled. | | RFA8 | BankID-appen svarar inte. Kontrollera att den är startad och att du har internetanslutning. Försök sedan igen. | The BankID app is not responding. Please check that it’s started and that you have internet access. Try again. | | RFA9 | Skriv in din säkerhetskod i BankID-appen och välj Identifiera eller Skriv under. | Enter your security code in the BankID app and select Identify or Sign. | | RFA13 | Försöker starta BankID-appen. | Trying to start your BankID app. | | RFA15 (A) | Söker efter BankID. Säkerställ att du har ett giltigt BankID på den här datorn. Om du har ett BankID på kort, sätt in kortet i kortläsaren. | Searching for BankID. Make sure you have a valid BankID on this computer. If you have a BankID on card, please insert the card into your card reader. | | RFA15 (B) | Söker efter BankID. Säkerställ att du har ett gitligt BankID på den här enheten. | Searching for BankID. Make sure you have a valid BankID on this device. | | RFA16 | Ditt BankID är för gammalt eller spärrat. Använd ett annat BankID eller skaffa ett nytt hos din bank. | Your BankID is blocked or too old. Please use another BankID or get a new one from your bank. | | RFA17 (A) | Du verkar inte ha BankID-appen/programmet. Installera den och skaffa ett BankID hos din bank. | You don't seem to have the BankID app/program. Please install it and get a BankID from your bank. | | RFA17 (B) | Misslyckades att läsa av QR-koden. Starta BankID-appen och läs av QR-koden. | Failed to scan the QR code. Start the BankID app and scan the QR code. | | RFA19 | Vill du använda BankID på den här datorn eller ett Mobilt BankID? | Would you like to use BankID on this computer, or a Mobile BankID? | | RFA20 | Vill du använda BankID på den här enheten eller på en annan enhet? | Do you want to use BankID on this device or another device? | | RFA21 | En identifiering eller underskrift pågår. | An identification or signing is in progress. | | RFA22 | Något gick fel. Försök igen. | Something went wrong. Please try again. | | RFA23 | Fotografera och läs av din ID-handling med BankID-appen. | Take a photo of, and scan, you ID document with the BankID app. | Terminology =========== | Description | Swedish | English | | --- | --- | --- | | Mobile BankID | Mobilt BankID | Mobile BankID | | BankID Security Application for mobile devices | BankID-appen | The BankID app | | BankID Security Application for PCs | BankID säkerhetsprogram | BankID Security Application | | Security code, password, PIN | Säkerhetskod (för Mobilt BankID)Lösenord (för BankID på fil)PIN (för BankID på kort) | Security code (for Mobile BankID)Password (for BankID on filePIN (for BankID on card) | | Sign | Skriv under | Sign | | Signature | Underskrift | Signature | | Identify | Identifiera | Identify | | Identification/authentication | Identifiering | Identification | General rules ============= API versions -------------- A new version of an API will be published on a new URL every time there's a breaking change in the API. You should always use the latest version of the API. The general rule is that old versions will be shut down 2 years after the release of the successor, unless shorter time is communicated. As new functionality is introduced to the system the behaviour of an existing version of the interface may change, e.g., existing faults may also be used in new situations.  Older versions of the service are being shut down successively. After May 1st 2024, the shutdown phase for versions 5.0 and 5.1 of the RP-API begun. This means that no updates are made and support has ended. The date of final shutdown will be communicated at least **2 months** in advance via our website and our technical newsletter. We recommend that you always use the latest versions of our APIs. Breaking changes ------------------ The table below describes the general principles for breaking changes. Security reasons may shorten the notice period.  * Breaking changes are done using a new end point and generally with a 2 year notice period.  * Non-breaking changes may be done without prior notice.  | Change | Breaking | To consider | | --- | --- | --- | | Add optional in-parameter | No | | | Adding required in-parameter | Yes | | | Remove any in-parameter | Yes | | | Add return-parameter | No | The implementation shouldn't discard the complete response if it includes unknown parameters. | | Remove any return-parameter | Yes | | | Remove method | Yes | | | Add method | No | | | Change issuer of server certificate | Yes | | | Add new hintCodes | No | If you receive an unknown hint code, a general message should be presented to the user. | | Add new errorCodes | No | If you receive an unknown error code, a general message should be presented to the user. | | Launch the BankID app | Yes | If the method used to launch the BankID app is changed, it will be done by marking the method as deprecated on this site and, after two years, eventually release a new version of the app that doesn't support the deprecated method. | Errors ====== Authentication and signature ------------------------------ | HTTP | Error code | Reason | RP action | | --- | --- | --- | --- | | 400 | alreadyInProgress | An auth or sign request with a personal number was sent, but an order for this user is already in progress. The order is aborted and no order is created. | Inform the user that an auth or sign order is already in progress. User message: RFA4. | | 400 | invalidParameters | Invalid parameter. Invalid use of method.Potential causes:Using an orderRef that has previously resulted in a completed order. An order can't be collected twice.Using an orderRef that has previously resulted in a failed order. An order can't be collected twice.Using an orderRef that is too old. Completed orders can only be collected up to 3 minutes and failed orders up to 5 minutes. Orders that have timed out beacuse they weren't picked up by the client are only available for collect for 3 min and 10 seconds.Using a different certificate than the one used to create the order.Using too big content in the request.Using non-JSON in the request body. | Don't try the same request again. This is an internal error within your system and shouldn't be communicated to the user as a BankID error. | | 400 | Unknown error code | We may introduce new error codes without prior notice, which can result in unkown error codes. You must have a way to handle unknown error codes in your implementation. | If an unknown error code is returned, inform the user with user message RFA22.Update your implementation to support the new error code. | | 401, 403 | unauthorized | You don't have access to the service. | Don't try the same request again. This is an internal error within your system and shouldn't be communicated to the user as a BankID error. | | 404 | notFound | An erroneous URL path was used. | Don't try the same request again. This is an internal error within your system and shouldn't be communicated to the user as a BankID error. | | 405 | methodNotAllowed, | Only http method POST is allowed. | Don't try the same request again. This is an internal error within your system and shouldn't be communicated to the user as a BankID error. | | 408 | requestTimeout | It took too long time to transmit the request. | Don't automatically retry. This error may occur if the processing on your end, or the communication, is too slow. Inform the user with user message RFA5. | | 415 | unsupportedMediaType | Adding a "charset" parameter after 'application/json' isn't allowed since the MIME type "application/json" has neither optional nor required parameters. | Don't try the same request again. This is an internal error within your system and shouldn't be communicated to the user as a BankID error. | | 500 | internalError | Internal technical error in the BankID system. | Don't automatically retry. Inform the user with user message RFA5. | | 503 | maintenance | The service is temporarily unavailable. | Try again without informing the user. If this error is returned repeatedly, inform the user with user message RFA5. | ### Example: response from collect with invalid orderRef HTTP/1.1 400 Bad Request Content-Type: application/json { "errorCode":"invalidParameters", "details":"No such order" } Digital ID card ----------------- The Verification of digital ID card from BankID provides error information to the RP through responses on the /rp/v1/verify endpoint. The API conveys error information using HTTP status codes and JSON response bodies with errorCode and an optional description field.  | HTTP | Error code | Description | | --- | --- | --- | | 400 | invalidParameters | A call to /rp/v1/verify couldn't be processed by our service due to malformed or invalid request data. This will return with HTTP 400 Bad Request status.Possible reasons:Invalid JSON in request body.Request body is too large.The passed qrCode has expired or is in some other way invalid. QR codes expire within some seconds and must be consumed within a short period of time. | | 400 | verificationFailed | A call to /rp/v1/verify was processed, but resulted in a non-valid validation of the presented ID card.Possible reasons:The QR code didn't correlate to a known ID card.The ID card was closed before the validation request could be completed.The ID card was revoked or expired. | | 401, 403 | unauthorized | You don't have access to the service. | | 404 | notFound | An erroneous URL path was used. | | 405 | methodNotAllowed | Only HTTP method POST is allowed. | | 408 | requestTimeout | Our service didn't receive a complete request message before its read timeout occurred. | | 415 | unsupportedMediaType | Adding a "charset" parameter after application/json isn't allowed since the MIME type "application/json" has neither optional nor required parameters. | | 429 | tooManyRequests | A call to /rp/v1/verify returns with HTTP 429 Too Many Requests status if you have called the APIs an excessive number of times. The response contains the following HTTP headers according to IETF draft-polli-ratelimit-headers-00 section 3:RateLimit-LimitRateLimit-RemainingRateLimit-ResetRead more about Rate-limiting | | 500 | internalError | A call to /rp/v1/verify couldn't be processed by our service for unexpected internal reasons. | | 503 | maintenance | Our service is temporarily unable to service the request. | ### Examples, digital ID card Please note that 400 Bad Request error responses having errorCode invalidParameters may provide additional information in the JSON response body description field.   {"errorCode":"invalidParameters","description":"Invalid json body"} {"errorCode":"invalidParameters","description":"Invalid QR code"} {"errorCode":"verificationFailed","description":"ID card verification not passed"} API overview ============ **End users need a BankID and the app** To use the BankID identification and signature features, end users must install the BankID app on a mobile device or a PC. They also need to order a BankID from their bank. **You need an agreement and a certificate** You use the BankID identification or signature services through the API. The API can only be accessed if you have a valid certificate. You order the certificate from the bank you have your agreement about the BankID service with. **When to use QR code and autostart** If the BankID app is installed on the same device as your service executes in, the BankID app can be launched automatically. If your service is running on another device, for example in a PC web browser, your service must present an animated QR code that the user will scan with their BankID app.  Endpoints with descriptions --------------------------- | Endpoint | Description | Comment | | --- | --- | --- | | /auth | Authentication. Identifies the user. | Used i.e. for log-in, access to e-services. | | /sign | A digital signature. | Used for digital signing of i.e. agreements and contracts. | | /payment | A digital signature for a payment. | Some functionality requires user’s BankID app at version 7.46 or later, or BankID for computer/card at version 7.17 or later. | | /payment/bulk | A digital signature for several payments at once. | Doesn’t support reccurrence, direct payments, NPAs, card payments or formatted texts. Requires user’s BankID app at version 7.46 or later, or BankID for computer/card at version 7.17 or later. | | /phone/auth | Authentication during a phone call. | Please note that there are differences for incoming and outgoing calls. | | /phone/sign | A digital signature during a phone call. | Please note that there are differences for incoming and outgoing calls. | | /phone/payment | A digital signature for a payment during a phone call. | Please note that there are differences for incoming and outgoing calls. | | /phone/payment/bulk | A digital signature for serval payments at once in a phone call. | Please note that there are differences for incoming and outgoing calls. | | /other/payment | A digital signature for card payments. | Using the endpoint /payment is preferred. Only use /other/payment for the edge case where neither autostart or QR code is feasible. | | /collect | Returns the information about the ongoing order. Also gives the status of the different steps of the order. | Should be polled until you get a success or failure. | | /cancel | Cancels an ongoing order of any type. | | #### Change log, version 6 2026-04-08 * Added new payment types and support for recurring payments to /payment.   * Added /payment/bulk.   * Added /phone/payment.   * Added /phone/payment/bulk.   **Please note:** The added functionality requires user’s BankID app being version 7.46 or later, or BankID for computer/card version 7.17 or later. Please ensure that you have a process in place for handling users on older versions.   2025-05-20 Added extra control (requirement mrtd) to /phone/auth and /phone/sign.  2025-04-30 Removed support for static QR code.  2024-10-22 Api descriptions and texts were updated for increased clarity.  2024-07-04 * Web and app parameters were added to all api that that can be initiated with autostart och QR code. * Added support for card payment transactions through the new endpoint /payment. 2024-05-02 * Added possibility to request a risk indication for an order, and to block orders with too high risk. * Added Possibility to send additional data ("web" and "app") for auth and sign. * returnUrl can now be provided in the order overriding any provided in the url that start the BankID client. 2024-02-21 * Updates made to hintCode for situations where the user's phone doesn't support a specific feature. * Improved description and recommendation for how to handle returned ip in collect. 2023-06-22 * Added the new endpoint /phone/sign for sign orders done over the phone.  * Added support for new call initiator for phone orders. This can now be both "user" and "RP", depending on who initiated the phone call.  2023-03-31  * New api version v6.0. * Added the new endpoint /phone/auth for auth orders done over the phone. ### Breaking changes resulting in new versions v. 6.0 (May 2023) ### **Changes** * New version of the RP API removing the option to start transaction based on personal number. * Support for identification in phone calls. **URL:** https://appapi2.bankid.com/rp/v6.0 HTTP/1.1 ---------- The service only supports HTTP/1.1. HTTP/1.0 won't work.  TLS versions -------------- appapi2.bankid.com requires TLS1.2 or TLS1.3.  OpenAPI --------- You can download the API reference for auth & sign as an OpenAPI yaml file. The file is version controlled in the document and updated as we add new features to the api and improve the documentation. [Download](https://developers.bankid.com/assets/openapi/openapi-auth-sign-6.1.9.yaml) Overview ======== If you want to verify the identity and age of end-users that identifies themselves using BankID digital ID cards, you can use Verification of digital ID card from BankID.  ### Summary of changes per version Version 1.0 (2023) First version.  Rate limiting --------------- The Verification of digital ID card from BankID service implements measures to protect the Relying Party API against excessive amounts of traffic from a relying party. All HTTP responses from the API contains RateLimit- headers in accordance with IETF draft-polli-ratelimit-headers-00 section 3: * RateLimit-Limit * RateLimit-Remaining * RateLimit-Reset If you exceed your quota in any way, subsequent invocations during the period will yield a HTTP response with HTTP 429 Too Many Requests. Contact teknikinfo@bankid.com to get the rate limit used for Verification of digital ID card from BankID.  OpenAPI --------- You can download the API reference for id-card as an OpenAPI yaml file. The file is version controlled in the document and updated as we add new features to the api and improve the documentation. [Download](https://developers.bankid.com/assets/openapi/openapi-id-card-v2.yaml) Good to know before testing ============================= * Avoid using production data in your test systems, as a test BankID can be created for any personal identity number. * There is no test BankID in production. A real BankID can only be held by a real person with a Swedish personal identity number. * In the test environment you don't get your own "displayName", but a certificate for test with displayName = BankID test. * When you create a test BankID, you choose a personal identity number and a name. Some numbers are used by many people, which can cause unexpected test results when several persons execute tests at the same time. We recommend you get personal identity numbers for testing from the [Swedish Tax Agency](https://www7.skatteverket.se/portal/apier-och-oppna-data/utvecklarportalen/oppetdata/Test%C2%AD%C2%ADpersonnummer). Test environment ------------------ Our test environment is free and open to all.   [How to access the test environment](https://developers.bankid.com/getting-started/environments) Issue a test BankID --------------------- In the test environment you need to use a test BankID. [Read about test BankID.](https://developers.bankid.com/test-portal/bankid-for-test) Download a certificate for test --------------------------------- By clicking the button below you will download a zip file containing the same certificate for test in three different formats. You also get a file with further information. **How to select the correct file:** * Use \`FPTestcert5\_20240610.p12\` for newer applications and environments that support modern encryption methods. We recommend this file as your primary choice. * Use \`FPTestcert5\_20240610.pem\` if your application requires PEM format. * Use \`FPTestcert5\_20240610-legacy.pfx\` for older applications requiring older algorithms, such as Windows Server versions earlier than 2022. [Download certificate for test](https://cdn.bankid.com/tools/FPTestcert5_20240703.zip) **Passphrase** The passphrase for the certificate is _qwerty123_ Testing scenarios ------------------- On the testing page you can test: * Verification of digital ID card.  * The eID service sign function, with a descriptive text of your choice.  [To testing page](https://developers.bankid.com/test-portal/testing) How to test "blocked BankID" ------------------------------ To test the scenario where a BankID is blocked, there are two ways that give the same result: 1. Issue a test BankID with a short validity time and test it when it's expired.  2. Enter the wrong security code for your test BankID five times to block it. How to configure a test BankID ------------------------------ **Steps to follow:** 1. Download the app/program. 2. Configure the client for test. 3. Issue a test BankID. 1\. Download the app/program ------------------------------ * Download the BankID app to your phone/tablet from Apple App Store or Google Play Store. * [Download BankID Security Application](https://install.bankid.com/) to your computer.  2\. Configure the client for test ----------------------------------- Once you have downloaded the app or program, you need to configure the client for test. Follow the instructions below for how to do this on Android, iOS or a computer. Typical errors you'd see if this configuration isn't done is “Invalid Credentials”, “BankID is missing” or error 10026 when trying to issue a BankID.  ### Android Follow these steps:  1. Uninstall any existing version of the BankID app and then install it again from Google Play Store. This step must be performed regardless of which version of the app is installed. 2. Put the phone in airplane mode. 3. Launch the BankID app. Dismiss any network failure warning or similar. 4. Go to **Settings** in the BankID app and select **Support**. 5. At the bottom of the support page, make a "long press" (i.e. press and hold) on the words **Error information**. 6. Enter **kundtest** in the box that appears and press OK. If no box appears, make sure your device is in airplane mode. 7. Check that it says **CUST** by version number. This verifies that you entered the correct information. 8. Exit the BankID app. 9. Exit the airplane mode. 10. Force quit the BankID app. It isn't enough to just put the BankID app in the background, the app must be completely quit in the device memory. There are several ways to do this depending on the device and operating system. The BankID app is now configured for the test environment. **Please note** * The app must be uninstalled/reinstalled to be restored for the production environment.  * The BankID app can't be run in emulated environments. * Apps that create a local, always turned on VPN connection (meaning that the VPN server runs on the phone and the phone connects to it) might interfere with the BankID test environment, even in airplane mode. ### iOS Start by uninstalling any existing version of the BankID Security App. Then reinstall it from App Store. 1. In **iOS Settings** → **BankID** → **Developer** → **Server**, enter **cavainternal.test.bankid.com**. 2. In the BankID app, go to **Settings → Support**. 3. At the bottom of the support page under "About BankID", check that it says **CUST** by version number. This verifies that you entered the information correctly. BankID Security App will now connect to the test server. **Please note**  * The app must be uninstalled/reinstalled to be restored for the production environment. ### Desktop (Windows and macOS) The BankID application must be configured for test. Please note that you can't use the application for both test and production with the same user account in your computer. You need to have either two separate accounts, or a separate computer for testing. **Create a setup for test** 1. Start the BankID application at least once after installation, and then exit it. 2. Open the folder with installation files for the BankID application, see below. 3. Create a text file named ”**CavaServerSelector.txt**” containing the word "**kundtest**". The file can be created with a text editor, i.e. Notepad for Windows or Pico in a terminal window for macOS. **Where to store installation files for BankID:** * Windows: %appdata%\\BankID\\Config (Generally a shortcut to: C:\\Users\\USER\\AppData\\Roaming\\BankID\\Config) * macOS: ~/Library/Application Support/BankID/Config This folder is hidden. To reach the folder via Finder (Desktop): Select the menu ”Go” and simultaneously press the ”Alt” key, then select ”Library”, ”Application Support”, ”BankID” and ”Config”. **Please note** * The BankID folder will be created when the BankID application is started. If you can't find the folder, please try to start and exit the application. 3\. Issue a test BankID ------------------------- When you've completeted step 1 and 2 it's time to issue a test BankID. You can do this on the testing page.  **Please note:** Your test BankID can be used on this website, but doesn't work on test.bankid.com since that's only for testing a production BankID.  [To testing page](https://developers.bankid.com/test-portal/testing) Common mistakes and problems ------------------------------ To use a test BankID you need to configure the BankID client software for test. Typical errors when this configuration isn't done is “Invalid Credentials” or “BankID is missing”. **Here are a few common mistakes:** * The client isn't restarted after it's been configured for test. To restart the client you must close it using the menu in the client. File → Exit. If not, the client may still execute in background. * The client isn't allowed to communicate with the server. If a proxy prohibits the communication it won't work. Study the log located in C:\\Users\\\\AppData\\Roaming\\BankID\\Logs. * An existing version of the Mobile BankID app isn't uninstalled prior to installing/configuring for the test environment.  Block and remove a test BankID -------------------------------- Your test BankID can be blocked and/or removed from a BankID client that's been configured for test. This can be done in the BankID Security Application or the BankID app.  ### Mobile BankID 1. Open your BankID app configured for test.  2. Go to settings.  3. Select 'Remove BankID'. ### BankID on card or file 1. Open your BankID Security Application configured for test.  2. For the BankID you want to block, select 'Manage BankID'.  3. Select 'Delete this digital ID from BankID'. Testing ======= This page is now replacing the former website demobanken. Test different flows in your BankID implementation below or issue a test BankID.  Before issuing a test BankID, make sure to prepare by following [this guide](https://developers.bankid.com/test-portal/bankid-for-test).  **Issue a test BankID** You can issue test versions of Mobile BankID and BankID on file. **Signature** Test the signature function using a test BankID. **Verification of Digital ID card** Create mock ID cards to test verification with your ID card scanner. [Issue Mobile BankID](https://developers.bankid.com/test-portal/testing/issue-test-bankid)[Issue BankID on file](https://developers.bankid.com/test-portal/testing/issue-test-bankid) [Test signature](https://developers.bankid.com/test-portal/testing/sign-test) [Test digital ID card](https://developers.bankid.com/test-portal/testing/digital-id-card) **Formatted descriptive text** Test your formatted descriptive text for BankID. [Test descriptive text](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) 2026-07-08 Test environment maintenance ============================ The **test** environment will undergo maintenance July 9th.  This may cause some disruptions. We're sorry for the inconvenience and appreciate your understanding.  Only test environment is affected --------------------------------- This will only affect the **test** envirnoment only, not production. 2026-04-08 Payment updates =============== Payments are a part of the API that is relevant for banks and third-party payment initiators, such as payment service companies and payment card issuing companies.   Payment is now being expanded with more payment types, support for recurring payments as well as a new option to show payment related warnings to the end-user. A new endpoint allowing for signing bulks of payments are added, and payment endpoints are also added for BankID in phone calls.  Apps without support are still in use ------------------------------------- The new functionality is supported by Mobile BankID app version 7.46 and higher, and the BankID program version 7.17 and higher. Older versions are still used. Before using the new functionality, you are advised to consider how to handle users on older versions.  /payment expansion ------------------ The existing endpoint /payment, previously containing only the two payment types card and npa, is now expanded with several new payment types:  * bankgiro: Bankgiro payment. * plusgiro: Plusgiro payment. * samebank: Same bank transfer. * domesticbank: Domestic bank transfer. * foreignbank: Foreign bank transfer. * direct: Direct payment. In addition, an option to show warnings to the end-user in the BankID-app is now available, read more below.  /payment/bulk is added ---------------------- A new endpoint is added to allow for several payments to be signed at the same time. This endpoint is similar to /payment, but has some key differences:  * Doesn't support reccuring payments, direct payment, card payments, or Non Payment Authentication (NPA).  * Supports descriptive text but not formatting. The new option to show warnings is available for this endpoint too, read more below.  Payment warnings and risk flags ------------------------------- An option to show warnings to the enduser in a payment situation is now available. The warnings are pre-defined and you choose when and if to use them. The purpose is to bring attention to potential risks and help the user detect if something isn't right. Please consider banner blindness, if warnings are constantly shown they will soon lose their power.  There is room for _one visible warning per payment,_ so you need to prioritise. How you use the solution is likely to depend on your business needs and your user's behaviour.  There is also an option to add risk flags, which are warnings that aren't displayed to the user. These are not yet in use, but added for planned future functionality.  A [how-to guide for payment warnings](https://developers.bankid.com/how-to-guides/warnings) has been added to this website.  #### Example: UI with warnings Payments for BankID in phone calls ---------------------------------- The payment endpoints are now also made available for BankID in phone calls. Therefore, there are two new endpoints added, corresponding to the ones mentioned above; /phone/payment and /phone/payment/bulk.  ### API specifications [/payment](https://developers.bankid.com/api-references/auth--sign/payment) [/payment/bulk](https://developers.bankid.com/api-references/auth--sign/payment-bulk) [/phone/payment](https://developers.bankid.com/api-references/auth--sign/phone-payment) [/phone/payment/bulk](https://developers.bankid.com/api-references/auth--sign/phone-payment-bulk) ### Learn more [How-to-guide: Warnings](https://developers.bankid.com/how-to-guides/warnings)  [API overview, info and changelog](https://developers.bankid.com/api-references/auth--sign/overview) [BankID in phone calls](https://www.bankid.com/en/business/channels/phone-calls) [Payments approval with BankID](https://www.bankid.com/en/business/about-the-service/payments) 2026-03-10 Update the BankID program for Windows before May 15 =================================================== To keep using BankID on card or file for Windows, all users need to update to version 7.16.2 before May 15, 2026.  Please note that the change only affects users of BankID on card or file for Windows. It doesn't affect users with macOS or Mobile BankID.   The update is available ----------------------- Most users can already update to the new version in their BankID-application. All users have received a message in the BankID program encouraging them to update to the new version.   The new version is also available at [install.bankid.com](https://install.bankid.com/) Organizations using a version with no automatic updates ------------------------------------------------------- If companies, authorities and organizations that use BankID security application in their environment but don't allow for automatic updates, their internal IT must install the new version and make it available to users. We recommend doing this as soon as possible.  ### Minor change The new version contains the same functionality and brings no differences to corporate integration or usage compared to the previous version. [Manual updates of the Enterprise version of BankID security application](https://www.bankid.com/en/business/enterprise/handle-the-program) 2026-03-02 Mobile BankID system requirements raised ======================================== To protect users and make scams more difficult the BankID app is continuously updated. As of March 2nd, we raise the system requirements to **iOS 16** and **Android 9**. Affected users have received information about the new system requirements well in advance in their BankID app. Users on older versions need to update their device to continue using their BankID.  [See all current systrem requirements](https://developers.bankid.com/getting-started/introduction) 2025-11-27 Updated website structure ========================= To make it easier to find the content you need, we have made some changes to the navigation and structure on this website. Here are the changes in short: * Use cases have now got their own section and the use cases have been divided into separate pages.  * Explanatory content pages have moved from "Getting started" to a new section called "How-to guides".  * Resources have been renamed "UI resources" and contain just that.  * The tool to test formatted descriptive texts have moved to the test portal. The guide for how to format the texts is placed in the "How-to guides" section.  Previoulsy used URLs are redirected so you should end up in the right place from any saved bookmarks or links.  We hope the changes make your work easier and our site more useful for you! 2025-09-30 RP-API 5.0 and 5.1 discontinued =============================== All API-versions older than 6.0 have now been discontinued. To keep using BankID in your services you need to use version 6.0.  If you are uncertain of what version your service is using, have a look at the URL your service calls to. If the URL ends with 5.0 or 5.1, you need to update your version.  Please note that there are breaking changes between the versions and there are some adjustments needed to your implementation.  How to update ------------- Follow the instructions on this website to get a secure and user friendly implementation of version 6.0 into your different services. You can use the service in many ways, such as websites, apps, phone calls, chat programs or even for access to physical spaces.  Here are some useful links, that are also found in the left-hand navigation on this website:  [Introduction to the service](https://developers.bankid.com/getting-started/introduction) [Autostart](https://developers.bankid.com/how-to-guides/autostart) [QR code](https://developers.bankid.com/how-to-guides/qr-code)  [Return URL](https://developers.bankid.com/how-to-guides/return-url) [API references, overview](https://developers.bankid.com/api-references/auth--sign/overview) 2025-09-08 API version 5.1 to be discontinued September 30th ================================================= In accordance with earlier communication, version 5.0 of our RP-API has now been discontinued. Next up is version **5.1** which will be **discontinued per the end of September**. In preparation for this, version 5.1 has now been discontinued in the test environment. To keep using BankID, all relying parties need to use version 6.0. Follow the instructions on this website for a correct implementation. Raised system requirements for Mobile BankID in March 2026 ---------------------------------------------------------- In March next year, the system requirements for Mobile BankID will be raised to: • iOS 16  • Android 9  User with an operating system that will need to be updated will receive information about this in their BankID app during the coming week. 2025-09-01 Version 5.0 of our RP-API is now discontinued ============================================= As per earlier announcements, version 5.0 of our RP-API has now been discontinued and can no longer be used.  All relying parties need to use version 6.0 instead. The contents and references on this website are for version 6.  If you are uncertain of what version your service is using, have a look at the URL your service calls to. The latest version URL is: https://appapi2.test.bankid.com/6.0. If the URL ends with 5.0 or 5.1, you need to update your version.  Here are some useful links, that are also found in the left-hand navigation on this website:  [Introduction to the service](https://developers.bankid.com/getting-started/introduction)  [Autostart](https://developers.bankid.com/how-to-guides/autostart)  [QR code](https://developers.bankid.com/how-to-guides/qr-code)  [Return URL](https://developers.bankid.com/how-to-guides/return-url) [API references](https://developers.bankid.com/api-references/auth--sign) 2025-05-26 Older API versions to be closed end of summer ============================================= All services need to use the latest version of the RP-API, version 6. In line with earlier communication, we now announce the closing of older versions 5.0 and 5.1.  A two-step process ------------------ The closing of the two older versions will be done separately, one month apart. Make sure to update to the latest version in time as no exceptions are possible.  • Version 5.0 will be closed **30th of August.**  • Version 5.1 will be closed **30th of September**.  As a part of the preparations, version 5.0 has been removed from the test environment. Version 5.1 will be removed from the test environment during the later part of the summer.  Use the latest version ---------------------- The contents and references on this website are for version 6. If you are uncertain of what version your service is using, have a look at the URL your service calls to. The latest version URL is: https://appapi2.test.bankid.com/**6.0**. If the URL ends with **5.0** or **5.1,** you are using a version that will be closed.  Here are some useful links, that are also found in the left-hand navigation on this website:  [Introduction to the service](https://developers.bankid.com/getting-started/introduction)  [Autostart](https://developers.bankid.com/how-to-guides/autostart)  [QR code](https://developers.bankid.com/how-to-guides/qr-code)  [Return URL](https://developers.bankid.com/how-to-guides/return-url) [API references](https://developers.bankid.com/api-references/auth--sign) A matter of security -------------------- Updates of our APIs brings important security measures. To protect companies as well as end-users it’s important that these measures are implemented. The general rule is that all services should use a new version within two years of it being launched.  [Read more about general rules](https://developers.bankid.com/api-references/general-rules) Extra control now available for BankID in phone calls ===================================================== In sensitive situations that require extra security measures, it’s possible to ask the user to perform an extra control. This is based on a scanning of the user’s machine readable travel document (mrtd), i.e. a valid Swedish passport or national ID card.  This option has now been made available for when the users are identifying themsleves or signing with BankID whilst in a phone call with your organisation.  Learn more ---------- [Read more about extra control ](https://developers.bankid.com/how-to-guides/extra-control)   [mrtd section for /phone/auth](https://developers.bankid.com/api-references/auth--sign/phone-auth) [mrtd section for /phone/sign](https://developers.bankid.com/api-references/auth--sign/phone-sign) 2025-05-07 Demobank moving to this website =============================== Soon, content and functionality on today’s Demobank will be moved to this website.  All you need in one place ------------------------- Our aim is to gather everything for developers on this site, making it easier to find and use. We are currently looking into test related content and functionality, and the next step is to integrate the Demobank here.  ### New home: Test portal The new content will be added to the test portal on this site. Just as today, you’ll be able to:   • Issue test BankID  • Test Verification of digital ID card  • Test Signature  Our latest additions -------------------- We keep working to improve this website and gather all you need here. The latest additions are:  • [Test your text](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) – a tool to test the descriptive texts you can add to your BankID flows.  • [Accessibility for QR codes](https://developers.bankid.com/how-to-guides/qr-code) – tips on how to meet the new [legal requirements](https://developers.bankid.com/news/coming-legal-requirements-will-affect-your-implementation). Support for static QR code has ended ==================================== To protect users and companies alike from being exposed to fraud, we've removed the possibility to use static QR codes with version 6 of our RP-API. The change to animated QR codes is a part of our continuous security work and is something we've recommended for many years.  In our more and more troubled world, it's necessary that the entire society comes together to increase security and safety. To us, this means to keep introducing new and more secure solutions as well as removing older ones.   Use animated QR codes --------------------- Ensure that you use an animated QR code in all flows for BankID in your services.  [Read about the QR code](https://developers.bankid.com/how-to-guides/qr-code)  Tip: Have a look at the accessibility section on the QR page as new legislation will come into force this summer, affecting the QR code in your BankID flows. 2025-03-21 Developers website to include more ---------------------------------- The purpose of this website is to provide everything developers need here. Over time other content, applications and materials for developers will be moved to this site.  ### Next step: sample code and demo Going forward, any sample code we provide will be found on this site in the form of snippets. You can find this on descriptive pages as well as on the API reference pages. The guiding code on Github will no longer be updated and thus the demo website generated by that code has been taken down.  #### Replacements * Viewing the flows for identification and signature to see how they work is possible on our [test site for endusers](https://test.bankid.com/). Just as before, you need to hold a production BankID to be able to execute the test.  * The possibility to try [formatting descriptive texts](https://developers.bankid.com/test-portal/testing/test-formatted-descriptive-text) is already available on this site. Please note that you should always test with a real app before launching.  ### More to come We are currently looking into the possibilty to move test related functionality to this site. We'll get back with more information on this later. Coming legal requirements will affect your BankID implementation ---------------------------------------------------------------- In the end of June 2025, new legal requirements will enter into force for digital accessibility of products and services in the private sector. The public sector is already covered by similar regulations.  For companies using BankID in their e-services this will, among other things, affect the flow used when the user visits the service on one device, but uses BankID on another. In this flow, an animated QR code is shown, which the user scans with their BankID app. The new requirements bring about changes to the QR code.  More information and example ---------------------------- To make it easier to meet the new requirements we have added an accessibility section to the [QR code page](https://developers.bankid.com/how-to-guides/qr-code).  There is also a [general information page available on bankid.com](https://www.bankid.com/en/accessibility/accessible-qr-codes) as well as a possibility to see the flow on our [test site for end-users](https://test.bankid.com/). You don’t need to perform the test to see the accessibility adjustments. 2025-03-05 Support for static QR code ends ------------------------------- The possibility of using static QR code with version 6 of our RP-API will be removed at the end of April. Please make sure to use animated QR code in all your user flows for BankID. Read about [QR code](https://developers.bankid.com/how-to-guides/qr-code) Older API-versions to be shut down ---------------------------------- The shutdown phase for versions 5.0 and 5.1 is moving forward and we wish to remind you to ensure that you’re using the latest version. The date of final shutdown will be communicated at least 2 months in advance in our [technical newsletter](https://developers.bankid.com/news/technical-newsletter). 2025-02-24 Endpoint overview added ----------------------- With time, more endpoints are added to the RP-API. To make it easier to find the right one, a table with all endpoints and descriptions for them has been added to the API overview page.  When more endoints are added, or if the scope for an endpoint is changed, this table will be updated.  [To overview page](https://developers.bankid.com/api-references/auth--sign/overview) 2025-01-22 New version of Keygen --------------------- Our program BankID Keygen is highly secure and well prorected. This is great, but it can also cause issues in the form of antivirus program warnings when downloading the program.  To help mitigate these issues we have now released an updated version of the program.  [The new version is available here](https://developers.bankid.com/getting-started/order-certificate/request-a-certificate) New page about Return URL ========================= When the BankID client is used on the same device as the user visits your service on, the user should be sent back to your service once they've completed their action in the BankID client.  It's possible and strongly recommended to send the return URL **via server,** meaning that you can protect the user and ensure that any sessions started from your service will send them back to your service. This can mitigate some session fixation cases.  We have added a page about this topic and hope it will provide help and guidance.  [Read about return URL](https://developers.bankid.com/how-to-guides/return-url) 2024-10-24 Mobile BankID system requirements change, March 2025 ---------------------------------------------------- To protect users and make scams more difficult the BankID app is continuously updated. In **March 2025**, we will raise the system requirement to iOS 15 and Android 8. This may be useful for developers of mobile apps where BankID is used.  Affected users will receive information about the new system requirement well in advance in their BankID app. 2024-10-14 Static QR code to be removed ============================ As part of the secure start initiative, static QR code support will be removed. The possibility of using static QR code together with version 6 of our RP-API will therefore be removed at the end of April. It's important that you make sure to use amimated QR code in all your user flows for BankID before this date. Examples of use cases --------------------- In addition to flows where you deliberately use static QR code, there may also be cases where other services use your services, for example through so-called "screen scraping" or APIs your organisation offer to other services. Check all your use cases to be sure that your flows will continue to work.  Related information ------------------- More information about dynamic QR codes can be found on the [QR code page](https://developers.bankid.com/how-to-guides/qr-code).  Technical instructions are available in the [API references](https://developers.bankid.com/api-references/auth--sign/overview) on this website, select the relevant endpoint for you in the left-hand navigation Read more about [secure start on bankid.com](https://www.bankid.com/en/foretag/secure-start) 2024-10-04 New endpoint '/payment' added ============================= Version 6 of the RP-API has received a new endpoint called payments. This makes it clearer for end-users that they are signing a card payment and enhances awareness for situations when the signature results in money leaving their account. This is an important factor to help mitigate fraud.  Currently for companies issuing payment cards --------------------------------------------- For now, this endpoint is specifically designed for situations when the end user signs a payment made with their card in your e-service. Therefore, it’s currently only relevant for companies issuing debit- and credit cards, as they are the ones calling the BankID service. The companies accepting card payments in their e-services should **not** use this endpoint at this time. The scope of the endpoint may expand in the future.   UI differences from signature ----------------------------- In practice, this is a signature, but the users experience some differences:   * The heading is card purchase instead of signature. * The descriptive text is ’I approve a purchase with my card from’ instead of ‘I sign at’.   * The icon displays a card instead of a pen.  * Strong focus on the amount, currency and the selling company.  ### Example of the user UI for /payment Possibility to add warnings --------------------------- The new endpoint is connected to a option to add warnings. These may be visible in the UI and aim to alert the user to identified enhanced risks. This can only be done by the company initiating the BankID signature. An e-service accepting card payments usually doesn’t initiate the signature, and the common case is that the card issuing company has this option.  ### Example of warnings in the UI Read more --------- Read more in the API specification, [section /payment](https://developers.bankid.com/api-references/auth--sign/payment) 2024-10-01 iOS system requirement change ============================= As of October 3rd, we are raising the system requirement for iOS devices to iOS14.  What it means for you --------------------- This may be relevant information mainly for those developing apps.  What is means for users ----------------------- The affected users have already received information in their BankID app. The users need to update their device to the latest OS to be able to continue using their BankID. 2024-09-20 New website for developers ========================== This website is brand new and is target at developers who integrate the BankID service into e-services of companies, public authorities and other organisations.  On this website you find general information on the service and how it works, useful resources, open API specifications, guides and more.  Replacing pages on bankid.com ----------------------------- This website is a replacement of the contents on bankid.com. The information is the same, but slightly restructured and rewritten to make it easeir to navigate and make use of.  Please update any bookmarks or links you may have to the old pages as these will not remain.  We hope you find the new website useful in your work!