GET https://sandbox.connect.hopae.com/auth?client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=openid%20profile&state=rf9Xy1
HTTP/1.1 302 Found
Location: https://app.example.com/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=rf9Xy1
OIDC
Start Authorization
Initiates the OIDC Authorization Code flow. Front‑channel redirect; no Authorization header.
GET
/
auth
GET https://sandbox.connect.hopae.com/auth?client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=openid%20profile&state=rf9Xy1
HTTP/1.1 302 Found
Location: https://app.example.com/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=rf9Xy1
Initiate user authentication by redirecting the browser to Hopae Connect’s
/auth endpoint.
Query Parameters
string
required
Your application’s OIDC client identifier.
string
required
Exact match to a pre‑registered redirect URI for your client.
string
default:"code"
required
Must be
code.string
default:"openid idv"
required
Space‑delimited scopes. Must include
openid idv. Supported: openid, idv.string
Recommended to bind the ID Token to a client session.
string
Request a minimum Level of Assurance. Format:
loa:{level} where level is 1–5.
See Level of Assurance for details.string
Required when initiating a match-capable provider over OIDC. A JWT carrying the values you want compared against the authoritative source.The result is returned via the standard userinfo flow with
- Algorithm:
HS256, signed with yourclient_secret. - Payload claim:
match_data— an object whose keys are OIDC-normalized names (seematchDatafield schema and Normalized User Data); fields with no normalized catalog entry keep their provider-native name. - Other claims: standard JWT (
iat,exp,jti) and OAuth/OIDC params (client_id,redirect_uri,state,nonce,scope) may also be carried in the JWT; if present they take precedence over their query-string equivalents.
Decoded payload
{
"client_id": "YOUR_CLIENT_ID",
"match_data": {
"name": "Test User",
"birthdate": "1990-01-01"
},
"iat": 1714060000,
"exp": 1714060300
}
verification_model: "match" — see Return Data Model.Behavior
- If successful, responds with
302 Foundto yourredirect_uriwithcodeandstatequery params. - On failure, redirects with
erroranderror_description(andstateif provided).
Examples
GET https://sandbox.connect.hopae.com/auth?client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=openid%20profile&state=rf9Xy1
HTTP/1.1 302 Found
Location: https://app.example.com/callback?code=SplxlOBeZQQYbYS6WxSbIA&state=rf9Xy1
HTTP/1.1 302 Found
Location: https://app.example.com/callback?error=access_denied&error_description=User%20cancelled%20login&state=rf9Xy1