Test

get

https://stg-id.singpass.gov.sghttps://id.singpass.gov.sg

/auth

Query parameters

client_idstringRequired

The client ID of the client

Example: yojGKYotEMq2uTFj2fLTTTdNxDaqPeQ3

response_typestringRequired

Response type

Example: code

esrvcstringOptional

A self-describing client external ID that is used for internal (billing) purposes

Example: my-dummy-cpf-eservice

classify_eservice_idstringOptional

A self-describing client external ID that MyInfo sends to us for internal (fraud analytics) purposes.

Example: my-dummy-cpf-eservice

redirect_uristringRequired

Redirect URI

Example: http://localhost:10000/callback

scopestring[]Required

OIDC/OAuth2.0 Scopes. Must minimally include openid for an ID Token

statestringRequired

A session-based, unique, and non-guessable value that the RP should generate per auth session. This parameter should ideally be generated and set by the RP’s backend and passed to the frontend. As part of threat modelling, NDI is requesting for the state parameter so as to mitigate replay attacks against the RP’s redirection endpoint (redirectUri). This parameter serves the same purpose as OAuth 2.0’s state parameter.

Maximum of 255 characters. Must match regexp pattern of [A-Za-z0-9/+_-=.]+

Example: state

noncestringRequired

A session-based, unique, and non-guessable value that the RP should generate per auth session. This parameter should ideally be generated and set by the RP’s backend and passed to the frontend.

Maximum of 255 characters. May be alphanumeric. We recommend that you use a hex-encoded random number such as java.security.SecureRandom or UUIDv4.

Example: nonce

code_challengestringRequired

Code challenge

Example: mkbVbjeX8QxKs-XCInqVqyr1ynHJRvF_ogjQKnCaOpU

code_challenge_methodstringRequired

Code challenge method. Currently only S256 is supported.

Example: S256

app_launch_urlstringOptional

The app launch URL is for Singpass App to redirect to the partner iOS mobile app. Android has native functionality to support this but iOS does not.

Example: yourapp://

redirect_uri_https_typestringOptional

(Required if the redirect_uri used is an app-claimed HTTPS URL) Supported values are app_claimed_https and standard_https (default). This value is ignored if the redirect_uri has a custom scheme.

Example: standard_https

Responses

200

For the app shortcut flow, the server will respond with a "200 OK" JSON response to Singpass App with the necessary data, instead of a redirect to a HTML page

application/json

302

302 Redirection of user to the Login Page with an unauthenticated Auth Session.

400

When there is an error in the app shortcut flow, the server will return a "400 Bad Request" JSON response instead of a redirect to a HTML page

application/json

get

/auth

HTTPcURLJavaScriptPython

GET /auth?client_id=yojGKYotEMq2uTFj2fLTTTdNxDaqPeQ3&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A10000%2Fcallback&scope=text&state=state&nonce=nonce&code_challenge=mkbVbjeX8QxKs-XCInqVqyr1ynHJRvF_ogjQKnCaOpU&code_challenge_method=S256 HTTP/1.1
Host: stg-id.singpass.gov.sg
Accept: */*

{
  "auth_ref": "Wz5K5nSsOBposZEOseIul",
  "is_rp_migrated": true
}