---
id: ext-passwordless-login
title: "Passwordless Login"
description: "Enable passwordless login using digital credentials from an EUDI Wallet via OpenID Connect"
hide_title: false
sidebar_label: Passwordless Login
keywords: [passwordless login, EUDI Wallet, OpenID Connect, OIDC, authentication, digital credentials, Organisation Wallet, European Business Wallet, identity provider]
slug: /extensions/passwordless-login
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


import NoteBox from '@site/src/components/NoteBox';
import ApiEndpoints from '@site/src/components/ApiEndpoint';

The Passwordless Login extension enables organisations to offer passwordless login using digital credentials presented from an EUDI Wallet. It integrates seamlessly with existing OpenID Connect (OIDC) identity management systems.

## How it works

1. The organisation enables the Passwordless Login extension from the dashboard.
2. An administrator creates one or more OIDC clients, each configured with a presentation definition, redirect URIs, and identity matching attributes.
3. When a user initiates login, they are redirected to the OIDC authorization endpoint.
4. The user presents the requested credential from their EUDI Wallet.
5. The system verifies the credential and extracts the linking value from the credential using the configured identity matching attributes.
6. The user is redirected back to the application with an authorization code, completing the login flow.

## OIDC discovery endpoints

Once the extension is enabled, the following OpenID Connect endpoints are available:

| Endpoint | Description |
|---|---|
| **Well-Known OIDC** (`/.well-known/openid-configuration`) | OIDC discovery document |
| **Well-Known JWKS** (`/.well-known/jwks.json`) | OIDC JWKS document |
| **Authorization Endpoint** | Redirects users to present credentials from their wallet |
| **Token Endpoint** | Secure server-to-server token exchange |
| **User Info Endpoint** | Returns authenticated user profile information |

## OIDC client configuration

Each OIDC client connects to your Identity Provider and defines how credential-based login is handled.

### Client fields

| Field | Required | Description |
|---|---|---|
| **Client Name** | Yes | A descriptive name for the client |
| **Presentation Definition** | Yes | Select which credentials to verify during login |
| **Action** | No | Free-text action value embedded in transaction data; used by the EUDI Wallet to render custom UI during the presentation request |
| **Redirect URIs** | No | URLs where users are redirected after login |
| **Web Origins** | No | Allowed CORS origins for browser-based flows |
| **Identity Matching Attributes** | No | A map of VCTs to claim paths used as linking values for identity matching. Each key is the VCT of a credential, and the value is the dot-separated path to the claim within that credential to use as the linking value. This is the recommended way to configure identity matching. |
| **Callback URI** | No | Optional HTTPS endpoint for complex identity matching scenarios. When set, the endpoint receives the credential presentation and returns the `sub` claim. Use this when you need custom logic beyond what Identity Matching Attributes can provide. |
| **Callback Secret** | Conditional | HMAC-SHA256 secret used to sign callback payloads. Required when **Callback URI** is set. |

### Identity matching attributes

**Identity Matching Attributes** allow you to configure which claims from presented credentials should be used as linking values for identity matching. It is specified as a map where each key is the VCT (verifiable credential type) of a credential, and the value is the dot-separated path to the claim within that credential to use as the linking value.

For example, if your presentation definition allows a credential with VCT `https://example.com/vct/drivers-license`, you could configure:
```json
{
  "https://example.com/vct/drivers-license": "email"
}
```

This tells the system to use the `email` claim from the drivers license credential for identity matching.

### Transaction data and action field

If the chosen presentation definition supports transaction data, the **Action** field can be used to pass a free-text value (e.g., `"Login to your online bank account"`) that is included in the transaction data sent to the EUDI Wallet. The wallet may use this value to display a custom UI to the user during the credential presentation (for example, showing a contextual message about what the login is for).

### Callback endpoint requirements

For most use cases, **Identity Matching Attributes** are sufficient. If you have more complex requirements for identity matching (e.g., custom logic, transformations, or external lookups), you can configure a **Callback URI** instead. When a **Callback URI** is configured, the endpoint must:

- Accept `POST` requests with a JSON body containing the credential presentation payload.
- Verify the `X-iGrant-Signature` HMAC-SHA256 header to authenticate the request. See [Webhook Security](/docs/openid4vc-webhooks/#webhook-security) for details on how to decode and verify the signature.
- Return a JSON response containing the `sub` (subject identifier) claim that maps the presented credential to a user in your IdP. This allows you to decide which field from the presentation (e.g., `email`) to use as the user identifier.

### Client management

From the dashboard, administrators can:

- Create new OIDC clients
- View and copy client credentials (Client ID and Client Secret)
- Edit client configuration
- Delete clients (with confirmation)
- View the associated presentation definition

**API endpoints:**

<ApiEndpoints endpoints={[
  { method: 'get', path: '/v3/config/extension/oidc/clients', description: 'List all OIDC clients' },
  { method: 'post', path: '/v3/config/extension/oidc/client', description: 'Create a new client' },
  { method: 'put', path: '/v3/config/extension/oidc/client/{clientId}', description: 'Update a client' },
  { method: 'delete', path: '/v3/config/extension/oidc/client/{clientId}', description: 'Delete a client' },
  { method: 'get', path: '/v3/service/extension/oidc/{organisationId}/.well-known/openid-configuration', description: 'OIDC discovery document' },
  { method: 'get', path: '/v3/service/extension/oidc/{organisationId}/.well-known/jwks.json', description: 'OIDC JWKS document' },
]} />

## Integration guide

For a step-by-step guide on configuring an IdP (Keycloak, Auth0, Ping Identity, etc.) as a relying party with this extension, including Identity Provider setup, custom authentication flows, and a sample React implementation, see the [Passwordless Login with EUDI Wallets](/docs/eudi-passwordless-login-flow/) guide.

<NoteBox title="Caution:" variant="caution">
Disabling the Passwordless Login extension deletes all OIDC clients and their configuration. This action is not reversible.
</NoteBox>