Passwordless Login
The Passwordless Login extension enables organisations to offer passwordless login using digital credentials presented from an EUDI Wallet. It integrates with existing OpenID Connect (OIDC) identity management systems.
How it works
- The organisation enables the Passwordless Login extension from the dashboard.
- An administrator creates one or more OIDC clients, each configured with a presentation definition, redirect URIs, and either identity matching attributes or a callback URI.
- When a user initiates login, they are redirected to the OIDC authorisation endpoint, which shows a QR code.
- The user presents the requested credential from their EUDI Wallet.
- The system verifies the credential and redirects the user back to the application with an authorisation code.
- The application exchanges the code for tokens. The system identifies the user with the configured identity matching attributes or callback URI.
OIDC discovery endpoints
Once the extension is enabled, the following OpenID Connect endpoints are available. All paths start with /v3/service/extension/oidc/{organisationId}.
| Endpoint | Path | Description |
|---|---|---|
| Well-Known OIDC | /.well-known/openid-configuration | OIDC discovery document |
| Well-Known JWKS | /.well-known/jwks.json | OIDC JWKS document |
| Authorization Endpoint | /auth | Redirects users to present credentials from their wallet |
| Token Endpoint | /token | Secure server-to-server token exchange |
| User Info Endpoint | /userinfo | Returns the sub of the user and the presented credentials |
OIDC client configuration
Each OIDC client connects to your Identity Provider and defines how credential-based login is handled.
Client fields
| Field | Required | Description |
|---|---|---|
| Name | Yes | A descriptive name for the client |
| Presentation Definition | Yes | The credentials to verify during login. See Presentation definition for the three ways to set it. |
| Action | Conditional | The login text that the EUDI Wallet may show to the user. Required when the presentation definition has Passwordless Login transaction data, otherwise not available. |
| Redirect URIs | No | URLs where users are redirected after login. The redirect URI of a login request must match one of them exactly. |
| Web Origins | No | The web origins of your application. |
| Identity Matching Attributes | One of the two | A map of credential identifiers to claim paths used as linking values for identity matching. Each key identifies a credential, and the value is the dot-separated path to the claim within that credential to use as the linking value. This is the recommended way to configure identity matching. |
| Callback URI | One of the two | Endpoint for complex identity matching scenarios. Use an HTTPS endpoint. When set, the endpoint receives the credential presentation and returns the sub claim. Use this when you need custom logic beyond what Identity Matching Attributes can provide. |
| Callback Secret | Conditional | HMAC-SHA256 secret used to sign callback payloads. Required when Callback URI is set. |
Configure either Identity Matching Attributes or Callback URI, not both.
Presentation definition
In the dashboard there are three ways to set the Presentation Definition:
| Way | What it does |
|---|---|
| Credentials | Pick one or more credentials, for example PID. A new presentation definition is created from them when you save. The user logs in with any one of them. |
| Existing presentation definitions | Select a presentation definition you already created. No new one is created. |
| Create new presentation definition | Build your own. It is created when you save. |
A presentation definition can be used by one client only.
Identity matching attributes
Identity Matching Attributes allow you to configure which claims from presented credentials should be used as linking values for identity matching. It is specified as a map with one entry for each credential of the presentation definition. Each key identifies the credential: the VCT (SD-JWT), the document type (ISO mdoc) or the type (W3C VC). The value is the dot-separated path to the claim within that credential to use as the linking value.
For example, if your presentation definition asks for the PID with VCT urn:eudi:pid:1 and the claim email, you could configure:
{
"urn:eudi:pid:1": "email"
}
This tells the system to use the email claim from the PID for identity matching.
Transaction data and action field
If the chosen presentation definition has Passwordless Login transaction data, the Action field passes a free-text value (e.g., "Log in to your online bank account") that is included in the transaction data sent to the EUDI Wallet. The wallet may use this value to display a custom UI to the user during the credential presentation (for example, showing a contextual message about what the login is for).
Callback endpoint requirements
For most use cases, Identity Matching Attributes are sufficient. If you have more complex requirements for identity matching (e.g., custom logic, transformations, or external lookups), you can configure a Callback URI instead. When a Callback URI is configured, the endpoint must:
- Accept
POSTrequests with a JSON body containing the credential presentation payload. - Verify the
X-iGrant-SignatureHMAC-SHA256 header to authenticate the request. See Webhook Security for details on how to decode and verify the signature. - Return HTTP 200 with a JSON response containing the
sub(subject identifier) claim that maps the presented credential to a user in your IdP. This allows you to decide which field from the presentation (e.g.,email) to use as the user identifier.
Client management
From the dashboard, administrators can:
- Create new OIDC clients
- View and copy client credentials (Client ID and Client Secret)
- Edit client configuration
- Delete clients (with confirmation)
- View the associated presentation definition
API endpoints:
- GET
/v3/config/extension/oidc/clients- List all OIDC clients - POST
/v3/config/extension/oidc/client- Create a new client - GET
/v3/config/extension/oidc/client/:clientId- Read a client - PUT
/v3/config/extension/oidc/client/:clientId- Update a client - DELETE
/v3/config/extension/oidc/client/:clientId- Delete a client - GET
/v3/service/extension/oidc/:organisationId/.well-known/openid-configuration- OIDC discovery document - GET
/v3/service/extension/oidc/:organisationId/.well-known/jwks.json- OIDC JWKS document - GET
/v3/service/extension/oidc/:organisationId/auth- Authorisation endpoint, also accepts POST - POST
/v3/service/extension/oidc/:organisationId/token- Token endpoint - GET
/v3/service/extension/oidc/:organisationId/userinfo- User info endpoint, also accepts POST
Integration guide
For a step-by-step guide on configuring an IdP (Keycloak, Auth0, Ping Identity, etc.) as a relying party with this extension, including Identity Provider setup, custom authentication flows, and a sample React implementation, see the Passwordless Login with EUDI Wallets guide.