Walley IdP Demo

Environment Which IdP instance to connect to. CI = continuous integration client_id Public identifier for the relying-party (RP) application. The IdP uses this to look up allowed redirect URIs, scopes, and client configuration. client_secret

Confidential credential that authenticates the RP at the token endpoint when exchanging an authorization code for tokens. Never exposed in the browser address bar. redirect_uri The URI the IdP redirects to after authentication, carrying the authorization code. Must exactly match a URI registered on the client — any deviation causes the request to be rejected.

Method (acr_values) Authentication Context Class Reference. Tells the IdP which eID method to invoke (e.g. Norwegian BankID, Finnish FTN) and at what assurance level. Leave blank to let the IdP route based on availability and cost. login_hint (national identity number) Optional national identity number (personnummer/hetu) forwarded to the eID provider to pre-fill its login form, saving the user from typing it manually. ui_locales BCP-47 language tag(s) in preference order (e.g. nb en). Controls the downstream eID provider's UI language. Not all providers honour all locales.

Norway

Finland

Denmark

openid Required for OIDC — tells the IdP to issue an ID token alongside the access token. Without it this is plain OAuth 2.0.

profile Requests standard profile claims (name, birthdate, etc.) in the ID token or from the UserInfo endpoint.

nin Requests the national identity number (NIN) claim. Only returned when the user authenticated via an eID that provides it.

walley.identity Requests the walley.identity audience on the access token, granting access to Walley-internal identity APIs.

offline_access Requests a refresh token so the RP can obtain a new access token without requiring the user to re-authenticate.

Use PAR Use Pushed Authorization Requests (PAR). POSTs authorization parameters to /connect/par first; the browser redirect carries only an opaque request_uri. Prevents parameter tampering and keeps the URL short (RFC 9126).

Send and verify nonce A random value generated by the RP and included in the authorization request. The IdP echoes it back inside the ID token. The RP verifies it matches to prevent replay attacks.

prompt Controls re-authentication. login forces a fresh login even if a session exists. none requires silent auth and returns an error if interaction is needed. consent re-prompts for scope approval. response_type code (recommended) returns only an authorization code; tokens are fetched server-side at the token endpoint, keeping them out of the browser address bar. acr_values override Free-text acr_values parameter sent verbatim to the IdP — takes precedence over the method picker above. Useful for testing custom or experimental ACR values. Takes precedence over the method picker. correlationId An optional trace identifier threaded through all IdP and downstream provider logs. Useful for support and debugging. Auto-generated by the IdP when omitted.

PKCE (Proof Key for Code Exchange) is always sent with S256. A one-time code_verifier/code_challenge pair is generated per request, preventing authorization code interception. The IdP enforces PKCE per FAPI 2.0 and rejects requests without it.

IdP status

Loading health…

Well-known resources

Discovery document JWKS

Raw discovery document

Loading…

Configure the request on the left and press Start identification to run a full authorization code flow against the Walley IdP.