---
title: "Offer BankID sign-in to Nordic users · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/bank-and-government-id/bankid-sign-in
id: ACC-73
level: Optional
applies: accounts
updated: 2026-10-22
tokens: 1007
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Offer BankID sign-in to Nordic users

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: ACC-73
- Level: Optional
- Chapter: [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md)
- Rule: If you serve Swedish or Norwegian users who need a verified identity, offer BankID through an identity broker or a bank agreement. Start each Swedish sign-in with a QR code or an app switch, never a typed ID number.
- Check: In the BankID test environment, a sign-in on a desktop shows a QR code whose content changes every second. A sign-in on a phone opens the app with an autostart token. No sign-in page has a field for an ID number.
- Applies when: The project has user accounts.
- How: Most adults in Sweden and Norway use BankID to sign in to banks and public services. Finland uses bank IDs through its trust network, and Denmark uses MitID. An identity broker, such as Signicat or Criipto, gives one OpenID Connect login for all of them. Swedish BankID has required a secure start since 2024. The page shows a QR code that changes every second, or opens the BankID app on the same device. The old start, where a person typed their ID number, let fraudsters on the phone start sign-ins for victims. Store the broker's subject as an identity row, as [Keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id.md) says. Store the ID number only as [Keep national ID numbers out of your data](https://agentwranglers.se/playbook/accounts/bank-and-government-id/national-id-numbers.md) allows.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { createHmac } from 'node:crypto'

export function bankIdQrContent(qrStartToken, qrStartSecret, orderCreatedAt, now = Date.now()) {
  const seconds = Math.floor((now - orderCreatedAt) / 1000)
  const authCode = createHmac('sha256', qrStartSecret).update(String(seconds)).digest('hex')
  return `bankid.${qrStartToken}.${seconds}.${authCode}`
}
```

### Python example

```python
import hashlib
import hmac
import time

def bankid_qr_content(qr_start_token: str, qr_start_secret: str, order_created_at: float) -> str:
    seconds = int(time.time() - order_created_at)
    auth_code = hmac.new(qr_start_secret.encode(), str(seconds).encode(), hashlib.sha256).hexdigest()
    return f"bankid.{qr_start_token}.{seconds}.{auth_code}"
```

## Sources

- [BankID secure start](https://www.bankid.com/en/foretag/secure-start)

## Related rules

- ACC-7 [Keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id.md) in Accounts and identity
- ACC-74 [Keep national ID numbers out of your data](https://agentwranglers.se/playbook/accounts/bank-and-government-id/national-id-numbers.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/accounts/bank-and-government-id/bankid-sign-in">Agent Wranglers accounts and identity playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Accept the EU Digital Identity Wallet where strong ID is needed](https://agentwranglers.se/playbook/accounts/bank-and-government-id/eu-identity-wallet.md)
- Next: [Keep national ID numbers out of your data](https://agentwranglers.se/playbook/accounts/bank-and-government-id/national-id-numbers.md)
- [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md)