Relying party documentation
Onboarding
How relying parties register, receive OAuth credentials, test in sandbox, and request production.
Integration journey
| Step | Actor | Action |
|---|---|---|
| 1 | Developer | Submit RP registration at /register-rp (broker integration path). |
| 2 | Platform admin | Review and approve; provision sandbox OAuth app on SXM Identity Broker. |
| 3 | Technical contact | Receive email with one-time link to redeem client ID and secret. |
| 4 | Developer | Store secret in vault; test in sandbox and RP portal (metadata only after redeem). |
| 5 | Developer | Implement OIDC using the integration standard; complete UAT (testing checklist + quickstart done-when). |
| 6 | Developer | Request production promotion from RP portal. |
| 7 | Platform admin | Promote app; new one-time credential link for production client. |
Step 5 UAT: follow the integration standard, §9 testing checklist, and quickstart done-when — including broker UserInfo and scope eid claims when your client is approved for them.
Credential delivery
Credentials are delivered through a one-time secure link — typically /developer/credentials?token=…. Redeem once; the client secret is not shown again in the RP portal.
What you must provide
- Exact redirect URI(s) — scheme, host, path, trailing slash must match runtime config.
- Post-logout redirect URI(s) if implementing federated logout.
- Technical and security contact emails.
- Application display name and organization for citizen-facing consent.
- Redirect URI on your public HTTPS origin — the platform derives
PortalBaseUrland adds your app to the citizen/RP launcher automatically on approve (no separate tile URL registration). - Standard scopes:
openid profile email eid— see Claims & identifiers.
Sandbox vs production
| Phase | OAuth application | Credentials |
|---|---|---|
| Sandbox | Provisioned after first approval | First one-time link |
| Production | Separate client after promotion | New one-time link — update all env vars |
RP portal
After login, the RP portal shows application status, redirect URIs, scopes, and stack-specific integration guides pre-filled for your client — without re-displaying the client secret.