For organisations
Claims and tokens
The short, accurate version for the sandbox. Every person in it is invented.
Every person is invented
In the sandbox the identity check is simulated. Every ID token says so, and your application must show that to its testers. There are no names, numbers, dates of birth, phone numbers or e-mail addresses to receive.
The ID token
| Claim | Value |
|---|---|
iss | The issuer, https://id-staging.digidghana.com |
aud | Your client id |
sub | An identifier for the person that is specific to your application: stable across logins, different for every other organisation, and not the person's internal DigiD Ghana id |
nonce, iat, exp, auth_time | As in OpenID Connect |
simulated | true: the identity behind this login was not checked by anyone |
verification_status | simulated_verified |
verification_label | A sentence containing “SIMULATED”, to show to people |
amr | ["dgi_device_key"]: the person approved with a key held on their phone |
Do not treat simulated_verified as proof of anything. A real identity check does not exist yet and when it does, it will be a different, clearly marked value that the sandbox never issues.
What there is not
- No
profile,email,phoneoraddressscope, and no personal attributes at all. - The
userinfoaddress answers with the subject only; do not build on anything more. - No claim is added because you ask for it. Claims are granted per application when your organisation is approved, and today the approved set is the list above.
Claims that may exist later
Any future claim will be listed here with how sensitive it is, and will need approval for your application and a screen where the person agrees. None of these exists today, and none is promised.
The tokens
| Token | Form | Lifetime |
|---|---|---|
| ID token | Signed (RS256) | 15 minutes |
| Access token | Opaque: a random string that means nothing to you | 15 minutes |
Refresh token (only with offline_access) | Opaque, replaced at every use | 7 days |
| Authorization code | Single use | Short: exchange it at once |
Lifetimes can change, so read expires_in from the answer instead of assuming them. Do not log tokens, codes or secrets.