Detailed Implementation

PKCE Implementation#

PKCE (Proof Key for Code Exchange) is mandatory. Generate a code verifier and challenge:

// Generate code verifier (43-128 characters) const codeVerifier = base64URLEncode(crypto.randomBytes(32)); // Generate code challenge const codeChallenge = base64URLEncode( crypto.createHash('sha256').update(codeVerifier).digest() );

Client Authentication#

A confidential client authenticates with its client_secret at the token endpoint, using whichever of client_secret_basic (the Authorization: Basic header) or client_secret_post (client_id and client_secret in the form body) the client is configured for. The pushed authorization request endpoint takes the same token_endpoint_auth_method, so one credential-handling routine serves both. A public client has no secret and relies on PKCE alone.

Scope and Claims#

Standard OIDC Scopes#

• openid - Required for OIDC. Returns sub claim

• profile - Returns profile information including:

• name, given_name, family_name, middle_name, nickname, preferred_username

• profile, picture, website, gender, birthdate, zoneinfo, locale, updated_at

• email - Returns email and email_verified claims

• phone - Returns phone_number and phone_number_verified claims

TrueVault Specific Claims (via claims parameter)#

Use the claims parameter to request specific TrueVault identity data:

Identity Claims (examples):

• trueidentity.credential - Identity verification credential

• trueidentity.given_name - Verified given name

• trueidentity.family_name - Verified family name

• trueidentity.birth_date - Verified birth date

• trueidentity.email - Verified email address

• trueidentity.phone - Verified phone number

• trueidentity.email_verified - Email verification status

• trueidentity.phone_verified - Phone verification status

• trueidentity.names_verified - Name verification status

• See Userinfo for full details.

Document Claims (examples):

• document.passport.travel_document_number - Australian passport or travel document number

• document.passport_foreign.passport_number - Foreign passport number

• document.driving_license.licence_number - Driver's license number

• See Userinfo for full details.

Credential Claims (examples):

• trueidentity.credential - Identity verification credential

• trueidentity.credential_valid - Identity verification credential valid

• vevortw.credential - VEVO Right to Work credential

• See Userinfo for full details.

Example Scope Combinations#

Basic Profile Access:

scope=openid profile email

Identity & Document Verification:

claims={"true": ["trueidentity.credential", "trueidentity.given_name", "trueidentity.family_name", "trueidentity.birth_date", "trueidentity.email", "trueidentity.phone", "trueidentity.email_verified", "trueidentity.phone_verified", "trueidentity.names_verified", "document.passport.travel_document_number", "document.passport_foreign.travel_document_number", "document.driving_license.licence_number"]}