> For the complete documentation index, see [llms.txt](https://docs.fortifiedid.se/access/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fortifiedid.se/access/key-components/authenticators/credential-validators/eid.md).

# FortifiedID eID

Configuration reference for FortifiedID eID authentication with SD-JWT verifiable credentials

The FortifiedID eID authenticator lets a user log in by presenting an SD-JWT verifiable credential from the FortifiedID mobile eID app. Access acts as the verifier and the browser UI automatically chooses app-switch on mobile devices or QR code on desktop devices.

## Configuration

{% hint style="info" %}
**Authenticator type:** `Eid`
{% endhint %}

Common authenticator configuration can be found [here](/access/key-components/authenticators/common-configuration.md).

The authenticator exposes the standard browser-side `start`, `state`, and `cancel` handlers. It also exposes public mobile endpoints under the authenticator context path so the eID app can fetch the proof request and post the signed presentation.

{% tabs %}
{% tab title="Properties" %}

<table data-full-width="true"><thead><tr><th>Name</th><th>Description</th><th>Default value</th><th data-type="checkbox">Mandatory</th></tr></thead><tbody><tr><td><code>base_path</code></td><td>Base path for the authentication flow.</td><td><code>${globals.default_login_suffix}</code></td><td>true</td></tr><tr><td><code>context_path</code></td><td>Externally reachable context path for this authenticator instance, used when building mobile request URLs if <code>audience</code> is not set.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>base_url</code></td><td>Externally reachable Access base URL, used together with <code>context_path</code> if <code>audience</code> is not set.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>audience</code></td><td>Audience value expected in the key-binding JWT and preferred external URL anchor for mobile endpoints.</td><td><code>""</code></td><td>true</td></tr><tr><td><code>accepted_issuer</code></td><td>Static issuer DID that this authenticator trusts. Use it as a fallback or additional allowlist entry during issuer key rotation.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>required_claims</code></td><td>Array of claim names that must be disclosed in the presentation. All disclosed claims are stored in global state after successful authentication.</td><td><code>[]</code></td><td>false</td></tr><tr><td><code>required_vc_type</code></td><td>Required SD-JWT VC type, matched against the credential <code>vct</code> claim.</td><td><code>https://service.idombud.se/eid/review/credentials/eid/v1</code></td><td>false</td></tr><tr><td><code>eid_server_base_url</code></td><td>Base URL for the eID server verifier-authorization endpoint.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>eid_server_org</code></td><td>eID server organisation short name. Also exposed to the browser UI and mobile proof request.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>verifier_client_id</code></td><td>OAuth client identifier used when Access fetches verifier authorization from the eID server.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>verifier_keystore_path</code></td><td>Path to the PKCS#12 keystore used to sign verifier request JWTs and authenticate against the eID server.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>verifier_keystore_password</code></td><td>Password for <code>verifier_keystore_path</code>.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>internal_http_destination</code></td><td>HTTP destination used for verifier authorization and, by default, status-list lookups.</td><td><code>default</code></td><td>false</td></tr><tr><td><code>issuer_auth_check_interval_ms</code></td><td>How often Access checks whether cached verifier authorization should be refreshed.</td><td><code>60000</code></td><td>false</td></tr><tr><td><code>issuer_auth_early_refresh_ms</code></td><td>How long before expiry the verifier authorization should be refreshed.</td><td><code>60000</code></td><td>false</td></tr><tr><td><code>issuer_display_name</code></td><td>Display name shown in the mobile app's identification request.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>deeplink_scheme</code></td><td>Deep link used to open the eID app on the user's device.</td><td><code>idombud://AUTHENTICATE</code></td><td>false</td></tr><tr><td><code>return_url</code></td><td>Return URL sent to the mobile app in the deeplink.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>success_location</code></td><td>Optional browser redirect location returned after successful authentication.</td><td><code>""</code></td><td>false</td></tr><tr><td><code>poll_frequency</code></td><td>Browser polling interval in seconds while waiting for the mobile app.</td><td><code>2</code></td><td>false</td></tr><tr><td><code>allowed_polling_for_minutes</code></td><td>Maximum time the browser and mobile session may remain pending.</td><td><code>5</code></td><td>false</td></tr><tr><td><code>session_store_sweep_interval_ms</code></td><td>Interval for removing expired pending mobile sessions from the in-memory session store. Set to <code>0</code> to disable the periodic sweep.</td><td><code>60000</code></td><td>false</td></tr><tr><td><code>qr_animated_enabled</code></td><td>Enables animated QR data where the browser rotates the QR URL with timestamp and signature.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>qr_animated_required</code></td><td>Rejects mobile request calls that do not include a valid animated QR timestamp and signature.</td><td><code>false</code></td><td>false</td></tr><tr><td><code>qr_refresh_sec</code></td><td>How often the browser should refresh animated QR data.</td><td><code>1</code></td><td>false</td></tr><tr><td><code>qr_window_sec</code></td><td>Accepted time window for animated QR values.</td><td><code>10</code></td><td>false</td></tr><tr><td><code>max_presentation_bytes</code></td><td>Maximum accepted mobile presentation body size in bytes.</td><td><code>65536</code></td><td>false</td></tr><tr><td><code>max_presentation_attempts</code></td><td>Maximum number of presentation attempts for one pending session.</td><td><code>3</code></td><td>false</td></tr><tr><td><code>clock_skew_seconds</code></td><td>Allowed clock skew when validating credential time claims.</td><td><code>60</code></td><td>false</td></tr><tr><td><code>kb_iat_window_seconds</code></td><td>Allowed age of the key-binding JWT <code>iat</code> value.</td><td><code>120</code></td><td>false</td></tr><tr><td><code>require_exp</code></td><td>Requires the credential to contain an expiry time.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>revocation_enabled</code></td><td>Enables token status-list revocation checks.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>status_list_http_destination</code></td><td>HTTP destination used when fetching token status lists.</td><td><code>internal_http_destination</code></td><td>false</td></tr><tr><td><code>status_list_reload_interval_ms</code></td><td>How long a cached token status list may be reused before Access reloads it.</td><td><code>3600000</code></td><td>false</td></tr><tr><td><code>status_list_cache_max_age_ms</code></td><td>Maximum accepted age for a cached token status list.</td><td><code>43200000</code></td><td>false</td></tr><tr><td><code>status_list_http_timeout_ms</code></td><td>Timeout for token status-list HTTP calls.</td><td><code>5000</code></td><td>false</td></tr><tr><td><code>require_credential_status</code></td><td>Rejects credentials without a status-list reference when revocation is enabled.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>verify_status_list_signature</code></td><td>Verifies the status-list JWT signature against the issuer key.</td><td><code>true</code></td><td>false</td></tr><tr><td><code>custom_identifier</code></td><td>Tag used for event separation.</td><td><code>""</code></td><td>false</td></tr></tbody></table>
{% endtab %}

{% tab title="Example" %}

```json
{
  "id": "eid01",
  "type": "Eid",
  "config": {
    "base_path": "/login/authn",
    "context_path": "/login/authn/eid01",
    "base_url": "https://access.example.com",
    "audience": "https://access.example.com/login/authn/eid01",
    "eid_server_base_url": "https://eid.example.com",
    "eid_server_org": "example-org",
    "verifier_client_id": "access-verifier",
    "verifier_keystore_path": "/opt/fortifiedid/config/eid-verifier.p12",
    "verifier_keystore_password": "${secret:eid-verifier-keystore-password}",
    "issuer_display_name": "Example organisation",
    "required_claims": [
      "personalIdentifier",
      "givenName",
      "surname"
    ],
    "required_vc_type": "https://service.idombud.se/eid/review/credentials/eid/v1",
    "revocation_enabled": true,
    "require_credential_status": true
  }
}
```

{% endtab %}
{% endtabs %}

{% hint style="warning" %}
Configure `verifier_keystore_path`, `verifier_client_id`, `eid_server_base_url`, and `eid_server_org` so Access can fetch verifier authorization and sign proof requests. `accepted_issuer` can be used as an additional static issuer allowlist entry.
{% endhint %}

## Flow

When the browser starts authentication, Access creates a pending eID session and returns both a deeplink and QR data. Mobile and tablet users are sent to the eID app through the deeplink. Desktop users scan the QR code with the eID app.

The eID app fetches a signed proof request from Access, asks the user to present the matching credential, and posts the SD-JWT VC presentation back to Access. Access verifies the issuer, credential type, required claims, nonce, audience, key-binding JWT, expiry, and revocation status before completing the authentication.

## Verification errors

Access does not expose internal verification codes to the browser. Failures such as an invalid signature, issuer, credential type, disclosure, key binding, nonce, audience, required claim, expiry, revocation, or unavailable status list are returned to the browser as `AUTHENTICATION_FAILED`.

User-driven states that require specific guidance remain distinct, including `USER_CANCELLED` and `RATE_LIMITED`. The internal error code and message are still written to system logging and event logging for troubleshooting.

## Public mobile endpoints

The mobile app calls these endpoints directly under the authenticator context path.

| Method   | Path                                                | Purpose                                                                                                                                                                                |
| -------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `GET`    | `{context_path}/mobile/request?id={sessionId}`      | Fetches the proof request, including nonce, audience, accepted issuers, required credential type, required claims, response URL, verifier request JWT, and verifier authorization JWT. |
| `POST`   | `{context_path}/mobile/presentation?id={sessionId}` | Delivers the signed SD-JWT VC presentation in `sdJwtPresentation`.                                                                                                                     |
| `DELETE` | `{context_path}/mobile/presentation?id={sessionId}` | Cancels a pending session.                                                                                                                                                             |

A mobile cancellation can also be sent as `POST` with header `X-EID-Cancel: true`. Cancellation requests must include `X-Session-Binding-Token` with the session nonce.

## Data exposed to global state

After a successful authentication, Access stores the claims disclosed by the credential presentation in global state. The exact set of stored keys depends on the claims requested in `required_claims` and on what the credential holder discloses. The key names match the claim names from the presentation, for example:

* `personalIdentifier`
* `givenName`
* `surname`

## Logging

Apart from system logging, event logging is done when starting, completing, failing, cancelling, or expiring a transaction.

Event ids are:

* WEB\_100030("FortifiedID eID authentication started")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)
  * AUTHENTICATOR\_IDENTIFIER (id and display name)
* WEB\_100031("FortifiedID eID authentication completed")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)
  * AUTHENTICATOR\_IDENTIFIER (id and display name)
  * givenName (if disclosed)
  * surname (if disclosed)
* WEB\_100032("FortifiedID eID authentication failed")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)
  * AUTHENTICATOR\_IDENTIFIER (id and display name)
  * MESSAGE (error code)
* WEB\_100033("FortifiedID eID authentication canceled or expired")
  * IDENTIFIER (user trace id)
  * CUSTOMER\_IDENTIFIER (if configured)
  * SOURCE\_ADDRESS (ip of the remote session)
  * AUTHENTICATOR\_IDENTIFIER (id and display name)
  * MESSAGE (reason)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fortifiedid.se/access/key-components/authenticators/credential-validators/eid.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.