Passwordless Login

The Passwordless Login extension enables organisations to offer passwordless login using digital credentials presented from an EUDI Wallet. It integrates seamlessly with existing OpenID Connect (OIDC) identity management systems.

How it works

1. The organisation enables the Passwordless Login extension from the dashboard.
2. An administrator creates one or more OIDC clients, each configured with a presentation definition, redirect URIs, and identity matching attributes.
3. When a user initiates login, they are redirected to the OIDC authorization endpoint.
4. The user presents the requested credential from their EUDI Wallet.
5. The system verifies the credential and extracts the linking value from the credential using the configured identity matching attributes.
6. The user is redirected back to the application with an authorization code, completing the login flow.

OIDC discovery endpoints

Once the extension is enabled, the following OpenID Connect endpoints are available:

Endpoint	Description
Well-Known OIDC (/.well-known/openid-configuration)	OIDC discovery document
Well-Known JWKS (/.well-known/jwks.json)	OIDC JWKS document
Authorization Endpoint	Redirects users to present credentials from their wallet
Token Endpoint	Secure server-to-server token exchange
User Info Endpoint	Returns authenticated user profile information

OIDC client configuration

Each OIDC client connects to your Identity Provider and defines how credential-based login is handled.

Client fields

Field	Required	Description
Client Name	Yes	A descriptive name for the client
Presentation Definition	Yes	Select which credentials to verify during login
Action	No	Free-text action value embedded in transaction data; used by the EUDI Wallet to render custom UI during the presentation request
Redirect URIs	No	URLs where users are redirected after login
Web Origins	No	Allowed CORS origins for browser-based flows
Identity Matching Attributes	No	A map of VCTs to claim paths used as linking values for identity matching. Each key is the VCT of a credential, and the value is the dot-separated path to the claim within that credential to use as the linking value. This is the recommended way to configure identity matching.
Callback URI	No	Optional HTTPS endpoint for complex identity matching scenarios. When set, the endpoint receives the credential presentation and returns the sub claim. Use this when you need custom logic beyond what Identity Matching Attributes can provide.
Callback Secret	Conditional	HMAC-SHA256 secret used to sign callback payloads. Required when Callback URI is set.

Identity matching attributes

Identity Matching Attributes allow you to configure which claims from presented credentials should be used as linking values for identity matching. It is specified as a map where each key is the VCT (verifiable credential type) of a credential, and the value is the dot-separated path to the claim within that credential to use as the linking value.

For example, if your presentation definition allows a credential with VCT https://example.com/vct/drivers-license, you could configure:

{
  "https://example.com/vct/drivers-license": "email"
}

This tells the system to use the email claim from the drivers license credential for identity matching.

Transaction data and action field

If the chosen presentation definition supports transaction data, the Action field can be used to pass a free-text value (e.g., "Login to your online bank account") that is included in the transaction data sent to the EUDI Wallet. The wallet may use this value to display a custom UI to the user during the credential presentation (for example, showing a contextual message about what the login is for).

Callback endpoint requirements

For most use cases, Identity Matching Attributes are sufficient. If you have more complex requirements for identity matching (e.g., custom logic, transformations, or external lookups), you can configure a Callback URI instead. When a Callback URI is configured, the endpoint must:

• Accept POST requests with a JSON body containing the credential presentation payload.
• Verify the X-iGrant-Signature HMAC-SHA256 header to authenticate the request. See Webhook Security for details on how to decode and verify the signature.
• Return a JSON response containing the sub (subject identifier) claim that maps the presented credential to a user in your IdP. This allows you to decide which field from the presentation (e.g., email) to use as the user identifier.

Client management

From the dashboard, administrators can:

• Create new OIDC clients
• View and copy client credentials (Client ID and Client Secret)
• Edit client configuration
• Delete clients (with confirmation)
• View the associated presentation definition

API endpoints:

• GET/v3/config/extension/oidc/clients - List all OIDC clients
• POST/v3/config/extension/oidc/client - Create a new client
• PUT/v3/config/extension/oidc/client/:clientId - Update a client
• DELETE/v3/config/extension/oidc/client/:clientId - Delete a client
• GET/v3/service/extension/oidc/:organisationId/.well-known/openid-configuration - OIDC discovery document
• GET/v3/service/extension/oidc/:organisationId/.well-known/jwks.json - OIDC JWKS document

Integration guide

For a step-by-step guide on configuring an IdP (Keycloak, Auth0, Ping Identity, etc.) as a relying party with this extension, including Identity Provider setup, custom authentication flows, and a sample React implementation, see the Passwordless Login with EUDI Wallets guide.

Caution: Disabling the Passwordless Login extension deletes all OIDC clients and their configuration. This action is not reversible.