Low
- How you are verified
- Self-declared details with a verified email address or mobile number.
- Authentication
- Password only
- Typical services
- Information requests, appointment booking, newsletters.
Level of Assurance
How much confidence a service needs
Assurance levels describe how strictly your identity was verified and how strongly you authenticate. Government applications and relying parties also read acr, amr, and auth_time in OIDC tokens.
Demo prototype — Citizen cards below illustrate the approved design. Authentication LoA URIs and amr codes in the lower section reflect platform OIDC policy (version 1.0).
Citizen identity assurance
Substantial
- How you are verified
- Civil Registry record match plus document check and a second authentication factor.
- Authentication
- Password + one-time code
- Typical services
- Most citizen transactions, permit applications, status requests.
High
- How you are verified
- In-person identity verification at a Public Service Center with biometric document check.
- Authentication
- Password + device-bound key, PKI-backed
- Typical services
- Legally binding signatures, business representation, sensitive records.
LoA 1–3 above describe identity verification at enrolment and typical login factors. Authentication LoA at sign-in (token acr values such as Substantial or High) is documented in the relying-party section below — both identity and authentication assurance can apply to the same session.
Raising your level
- Start at Low with Self-Registration in a few minutes.
- Reach Substantial once your details match the Civil Registry and your second factor is active.
- Reach High by completing an in-person check at a Public Service Center.
For relying parties — authentication LoA in OIDC
When a citizen signs in, the eID platform issues OIDC ID tokens that include acr (authentication context), amr (authentication methods), and auth_time (when authentication occurred). Production RPs integrate through the SXM Identity Broker — read these claims from the broker ID token (and profile claims from UserInfo per your allow-list). Claims & identifiers.
Authentication assurance levels (acr)
Substantial (LoA 2)
Substantial assurance
Citizen authenticated with password plus a second factor (SMS OTP or authenticator app). This is the default assurance level for government sign-in after MFA.
https://eid.gov.sx/loa/substantialHigh (LoA 3)High assurance
Citizen authenticated with a FIDO2 passkey (WebAuthn). Phishing-resistant hardware or platform authenticator.
https://eid.gov.sx/loa/highSubstantial — SSOSubstantial assurance (SSO resume)
Citizen reused an existing eID portal session to access another application without repeating MFA. The original authentication time is preserved in auth_time.
https://eid.gov.sx/loa/substantial-ssoAuthentication methods (amr)
| amr | Meaning |
|---|---|
pwd | Password verified |
sms | SMS one-time password (MFA) |
otp | TOTP authenticator app (MFA) |
hwk | Hardware key / passkey (WebAuthn) |
session | Existing portal session reused (SSO resume) |
recovery | MFA recovery flow completed |
OIDC claims
| Claim | Description |
|---|---|
acr | Authentication Context Class Reference — LoA URI for this login |
amr | JSON array of authentication methods used (e.g. pwd, sms, hwk) |
auth_time | Unix timestamp when the user authenticated |
eID OIDC discovery lists acr_values_supported and claims_supported: https://sxm-api-stage.orangebd.com/.well-known/openid-configuration. Broker metadata: https://localhost:9443/oauth2/oidcdiscovery/.well-known/openid-configuration.
Identity vs authentication assurance
- Identity assurance (IAL) — PSC enrolment, document verification, UIN/eID issuance (citizen cards above).
- Authentication assurance (LoA) — login and MFA at sign-in (acr / amr / auth_time).
High identity assurance at enrolment does not replace LoA at login; both apply.