Offer BankID sign-in to Nordic users

How to do it

Most adults in Sweden and Norway use BankID to sign in to banks and public services. Finland uses bank IDs through its trust network, and Denmark uses MitID. An identity broker, such as Signicat or Criipto, gives one OpenID Connect login for all of them. Swedish BankID has required a secure start since 2024. The page shows a QR code that changes every second, or opens the BankID app on the same device. The old start, where a person typed their ID number, let fraudsters on the phone start sign-ins for victims. Store the broker's subject as an identity row, as Keep your own user ID says. Store the ID number only as Keep national ID numbers out of your data allows.

Examples

JavaScript example

import { createHmac } from 'node:crypto'

export function bankIdQrContent(qrStartToken, qrStartSecret, orderCreatedAt, now = Date.now()) {
  const seconds = Math.floor((now - orderCreatedAt) / 1000)
  const authCode = createHmac('sha256', qrStartSecret).update(String(seconds)).digest('hex')
  return `bankid.${qrStartToken}.${seconds}.${authCode}`
}

Python example

import hashlib
import hmac
import time

def bankid_qr_content(qr_start_token: str, qr_start_secret: str, order_created_at: float) -> str:
    seconds = int(time.time() - order_created_at)
    auth_code = hmac.new(qr_start_secret.encode(), str(seconds).encode(), hashlib.sha256).hexdigest()
    return f"bankid.{qr_start_token}.{seconds}.{auth_code}"

How to check

In the BankID test environment, a sign-in on a desktop shows a QR code whose content changes every second. A sign-in on a phone opens the app with an autostart token. No sign-in page has a field for an ID number.

Sources

• BankID secure start

Related rules

• ACC-7 Keep your own user ID in Accounts and identity
• ACC-74 Keep national ID numbers out of your data in Accounts and identity