DOCS- e-IDs
- Norwegian BankID
e-IDs
Norwegian BankID
Learn more about Norwegian BanKID token contents, how to create test users and how to gain access to production.
JWT/Token examples
Kodebrikke and Mobile authenticators
The level of assurance for these authenticators are: High
The uniqueUserId identifies the legal person corresponding to the login, and is not considered sensitive.
Biometric authenticator (BankID app)
The level of assurance for this authenticator is: Substantial
Note that there is no certsubject returned when using Biometrics.
Test users
Two types of Norwegian BankID are available:
- Web based BankID with a hardware token. Also called Netcentric accounts, test users from this type of BankID may be created and used on the fly
- Mobile BankID. Norwegian mobile BankID is based on a socalled SIM card application which means you need a special SIM card issued by one of the Norwegian carriers.
Creating netcentric test users
Test users are created through the web page at https://ra-preprod.bankidnorge.no/#/search/endUser.
- Go to the "TEST NUMBER GENERATOR" to generate a random, valid SSN
- It now says "Could not find any bankIDs for ..."
- Fill out the first name, last name, and BankID friendly name.
- Click "Order" to initiate the process
- Once the process complete you now have a test user. User name is the generated SSN, one time password (OTP) is always "otp", and password is always "qwer1234"
It can take up to 1 hour before a newly created test user is activated.
You can test it out at our authentication demo site, which is a small sample hosted by Criipto.
Testing BankID Biometric
Start by creating a netcentric test user as described above, and add an email and a phone number to the user.
Install the test-version of the BankID App (on iOS, it is distributed via TestFlight).
The app must be activated before first use:
- Press the Get started button
- Press the Activate BankID App button
- Press Continue
- Enter the birth number (SSN) for the test user you created and press the Next button
- Press the Get activation codes button
- Press the Next button
- Enter the phone number you associated to the test user and press the Next button
- Open the following page to get your activation codes (after replacing the
{yourTestSsn}placeholder with your actual test-SSN): https://ra-preprod.bankidnorge.no/notification-console/content/{yourTestSsn} - Type the one-time code that is shown on the website into the app and press the Next button
- Press the Next button in the "Is this your email?” screen
- Type the code words that is shown on the website into the app and press the Next button
- Press the Next button in the "Log in using BankID to complete the activation” screen
- Wait until BankID client has loaded in the browser. Pick BankID app in the method list if it is not already preselected.
- Type "qwer1234” as personal password and click the blue arrow button to the right
- A progress bar will appear and when finished you will be activated
- Enable biometrics (which will take you through a flow where you must agree to the terms and conditions).
- Run your first biometrics-based login.
Testing Mobile BankID
For testing you may order up to three test SIM cards through Criipto once you have signed up for Norwegian BankID.
Data and consent for Norwegian BankID
Available data / scopes
Basic user information, full name, and date of birth are always made available. Additional data may be requested and is released with explicit user consent only.
For applications configured to use a dynamic scope strategy, the following scope tokens can be supplied: address, email, phone and ssn.
| Data type | Released | Verified | scope | login_hint |
|---|---|---|---|---|
| Full name | Always | Yes | ||
| Date of birth | Always | Yes | ||
| SSN ("fødselsnummer" in Norwegian) | User consent | Yes | ssn | scope:ssn |
| Address | With user consent | No | address | scope:address |
| With user consent | No | email | scope:email | |
| Phone number | With user consent | No | phone | scope:phone |
Example (partial) authorize request with scopes
https://YOUR_SUBDOMAIN.criipto.id/oauth2/authorize?scope=openid email address&...
Alternatively, you can send them in the login_hint
https://YOUR_SUBDOMAIN.criipto.id/oauth2/authorize?...&login_hint=scope:email scope:address&...
which can be a useful if you are working with technology that does not let you control the scope value.
Access to the SSN is governed by Norwegian law, as described in the Ordering Norwegian BankID guide.
The unverified data are supplied by end-users and not verified by Bidbax (operator of BankID) or the Norwegian banks.
Consent model
End-users must explicitly grant consent to releasing the data to you.
The consent model is enforced by Bidbax, and they also provide the consent and data collection dialogs.
Forced and optional consent
If you request SSN, it will be treated as a required value. End users will not be allowed to complete a login until they have explicitly given their consent to release SSN.
All other additional data are treated as optional values. A login may complete even if the user does not consent to release the requested data.
Consent to SSN will be stored by Criipto for 1 year for your tenant, after which the user must provide explicit SSN consent again.
Criipto does not store the SSN itself, just the fact that the user has granted your tenant access to it.
You can add a "forget-me" link on your website if you want to let users revoke the consent again. Use a normal authorize request as target, but add a prompt=consent_revoke query parameter to the request. Criipto will then run a login flow (to be able to recognize the end user), and delete the granted consent.
You can learn more about authorize requests in our authorize URL builder.
Configuration
You can use the Criipto management dashboard dashboard.criipto.com to configure access to the optional user data, in the Identity Sources -> NO BankID section.
Ordering Norwegian BankID
To start accepting real users with Norwegian BankID, you must first request your client credentials from Bidbax. The credentials consists of a client id and a client secret.
Prerequisites for ordering
In order to apply for the BankID client credentials for a company you must meet the basic requirements:
- Your company must be a customer of a Norwegian Bank. Most banks in Norway are part of the BankID network.
- The person that will sign the contract must be in possession of one of these personal e-IDs: Norwegian BankID, Swedish BankID, or Danish NemID
- You must have completed step 5 in the Getting ready for production guide. You will need the production domain to complete the order for your client credentials.
New customers
The BankID OIDC Biometrics option is now available when ordering BankID.
Biometrics is always included in the basis agreement.
Existing customers
Due to new terms and conditions in the agreement, you must send us an updated application if you wish to use BankID Biometrics.
About BankID Biometrics
BankID Biometrics assurance level is “Substantial”.
If you can only use assurance level “High” in your login flow, you must explicitly specify the login_hint=BID in your authorize requests to Criipto Verify, as described in our guide on prefilled fields
Learn more about assurance levels
Or feel free to reach out, either on Slack or via support@criipto.com
Ordering the client credentials
To order production credentials please send a request to
with answers to these questions:
- A short description of what your application does and why it needs BankID.
- Your company: Name, organisation number, and address
- Does your company pay MVA (Merverdiavgiftsregisteret)?
- General contact person at your company for BankID related communication: Name, mobile phone, and email
- Your company’s Norwegian bank: Name, organisation number, and address
- Contact person with authorization to block/revoke the use of BankID: Name, mobile phone, and email
- Person registered in the business registry with authorization to sign the agreement: Name and email
- If you need access to social security numbers (“fødselsnummer”) please provide brief explanation of why and reference the Norwegian law and paragraph that grant you the right
- Contact person with authorization to receive the credentials: Name, mobile phone, and email
- The display name to appear in the login app. E.g. the name of your company or your specific service. (See the image below)
- Web address of your company
- The URL of your production domain as setup in step 5 of the Getting ready for production
- Finally - if you are not a Norwegian company - you must enclose a company certificate from the official business registry of the country of incoporation.
Next steps
After Criipto has received the above information, we order the client credntials from your bank by filling out an online agreement, which is then sent to the appointed persons at your company for signing. Criipto will also sign the agreement
When all signatures are in place the signed agreement is sent to your bank for further processing and eventual issuance of your client credentials.
Once you have received credentials, they must be entered into the Criipto Verify management UI to configure your NO BankID integration.