Government of Sint Maarten — Digital Identity Platform

Relying party documentation

Quickstart

Validate the end-to-end OIDC flow in the developer sandbox before wiring the broker into your application.

Register relying partyDeveloper sandboxRP portal

Two integration paths

PathWhen to useDiscovery
Production RP (recommended)Government portals and partner systems after onboardinghttps://localhost:9443/oauth2/oidcdiscovery/.well-known/openid-configuration
Direct eID sandboxLocal conformance, seeded demo clients, /sandbox UIhttps://sxm-api-stage.orangebd.com/.well-known/openid-configuration

Sandbox login (15 minutes)

  1. Register your relying party or use an admin-provisioned sandbox client.
  2. Wait for approval — technical contact receives a one-time credential link.
  3. Open the developer sandbox and start OIDC login with PKCE (S256).
  4. Sign in with test eID SXM-123456782 and complete MFA (demo SMS OTP when enabled).
  5. Confirm callback at /auth/callback — exchange the code, inspect ID token claims, then GET broker UserInfo with the access_token (UserInfo API details). Illustrative JSON on the Claims page may show a different sample eid; your sandbox login should return this citizen's card number (SXM-123456782) when scope eid is granted.

Test identities

eID (username)StatusUse
SXM-123456782ActiveHappy-path login + MFA
SXM-200002004RevokedLogin blocked
SXM-300003006SuspendedLogin blocked

Broker environment variables

After onboarding, configure your app against the broker (not the eID API directly):

.env excerpt
WSO2_BASE_URL=https://localhost:9443
WSO2_CLIENT_ID=YOUR_CLIENT_ID
WSO2_CLIENT_SECRET=YOUR_CLIENT_SECRET
WSO2_REDIRECT_URI=https://your-app.gov.sx/auth/callback
WSO2_SCOPE="openid profile email eid"
WSO2_AUTHORIZE_URL=https://localhost:9443/oauth2/authorize
WSO2_TOKEN_URL=https://localhost:9443/oauth2/token
WSO2_USERINFO_URL=https://localhost:9443/oauth2/userinfo
WSO2_LOGOUT_URL=https://localhost:9443/oidc/logout

Done when

  • Authorize redirect includes PKCE S256 and state.
  • Token exchange returns id_token with stable sub.
  • UserInfo GET https://localhost:9443/oauth2/userinfo returns 200 with Bearer access_token (not the id_token).
  • When scope eid is granted, UserInfo includes approved eid bundle (e.g. eid, citizen_status, rp_token).
  • Wrong redirect URI fails at broker (expected).
  • Revoked test identity cannot complete login.