Test people

Nobody real can log in to the sandbox: every person is invented. Testers use the DigiD Ghana test app, which makes up a person the first time it starts and says so on every screen.

How a tester logs in to your application

1. The tester installs the test app and sets a PIN code. A made-up person is created on the phone; no document is checked.
2. They open your application and choose “Log in with DigiD Ghana”.
3. They follow the steps on the integration page: the verification code and QR code on another device, or the button on the phone they are holding.
4. Your application receives an ID token that says simulated: true.

To get the test app for your testers, write to info@digidghana.com.

What to test

• A successful login, and the person cancelling in the app.
• A login left to expire.
• A second login by the same tester: sub must be the same.
• A refresh, and a refresh with an old token (it must fail).
• The tester removing their phone or logging out everywhere in the app: your next refresh must fail and your application must ask them to log in again.
• Your own handling of a wrong state or nonce, which must refuse the login.

What is not possible yet

• Real people, real identity checks and any connection to the National Identification Authority.
• Production: it needs a separate approval by two reviewers.
• Account recovery, text messages, e-mail and push notifications; they are switched off.
• Staying logged in without approving again.