Skip to main content
GET
Initiate user authentication by redirecting the browser to Hopae Connect’s /auth endpoint.

​
Query Parameters

​
string
required
Your application’s OIDC client identifier.
​
string
required
Exact match to a pre‑registered redirect URI for your client.
​
string
default:"code"
required
Must be code.
​
string
default:"openid idv"
required
Space-delimited scopes. Include openid idv. The verification result (user, provenance, missing_claims, match) is released only under idv or its alias hopae. profile, email, phone and address are accepted but add no claims, because verified attributes are returned under user.
​
string
Recommended to bind the ID Token to a client session.
​
string
Space‑separated verification constraints:
  • urn:hopae:loa:{level} requests a minimum Level of Assurance (1 to 5, or none, low, substantial, high, qualified). For example, urn:hopae:loa:3.
  • urn:hopae:id:{providerId} limits the eID choice to one provider, or to a comma-separated list. For example, urn:hopae:id:mitid,bankidse.
A bare loa:3 without the urn:hopae: prefix is ignored. See acr_values format and Level of Assurance.
​
string
The workflow to apply to this verification. Workflow IDs look like wf_abc123 — find them in the Console on your app’s Workflows page.
  • When omitted, your app’s default workflow is used.
  • When the ID does not match any workflow in your app, the request falls back to the default workflow instead of failing.
Equivalent to the workflowId body field of the REST API Create Verification request.
​
string
Required when initiating a match-capable provider over OIDC. A JWT carrying the values you want compared against the authoritative source.
  • Algorithm: HS256, signed with your client_secret.
  • Payload claim: match_data — an object whose keys are OIDC-normalized names (see matchData field schema and Normalized User Data); fields with no normalized catalog entry keep their provider-native name.
  • Other claims: standard JWT (iat, exp, jti) and OAuth/OIDC params (client_id, redirect_uri, state, nonce, scope) may also be carried in the JWT; if present they take precedence over their query-string equivalents.
Decoded payload
The result is returned via the standard userinfo flow with verification_model: "match" — see Return Data Model.

​
Behavior

  • If successful, responds with 302 Found to your redirect_uri with code and state query params.
  • On failure, redirects with error and error_description (and state if provided).

​
Examples