Skip to main content

​
Overview

The Authentication Context Class Reference (acr) from OpenID Connect represents the Level of Assurance (LoA) of an authentication event. Hopae aligns with IETF/IANA standards (RFC 6711; IANA OIDC ACR Registry) and adds a developer‑friendly numeric hopae_loa and human‑readable hopae_loa_label.
  • Namespace: urn:hopae:<acr_value>
  • Values: loa1 → loa5
  • Returned fields: acr (string), hopae_loa (int), hopae_loa_label (string)

​
Why it exists

  • Defined in OIDC Core §2; registered values in RFC 6711 and IANA registry
  • Lets Relying Parties request a minimum assurance (e.g., “at least loa3”)
  • Common in regulated flows for step‑up authentication and policy controls

​
Hopae LoA levels

ACR ValueAliashopae_loaDescriptionTypical MethodseIDASNIST
urn:hopae:loa1low1No verified ID link; very weakEmail link, SMS OTP (no KYC)LowIAL1/AAL1
urn:hopae:loa2medium2Limited KYC; telecom/soft IDPASS (KR), Aadhaar OTP (IN)–IAL1–2
urn:hopae:loa3substantial3Trusted eID; strong single factorBankID Substantial, SingPassSubstantialIAL2/AAL2
urn:hopae:loa4high4Multi‑factor + crypto bindingBankID High, Smart‑ID High, FIDO2+biometricHighIAL3/AAL3
urn:hopae:loa5qualified5Qualified signature / max trustQES smartcard + PIN + biometricHigh+/QESIAL3+
Use hopae_loa (int) for comparisons

​
API response examples

ID Token
{
  "iss": "https://sandbox.connect.hopae.com",
  "sub": "wPqH84Q4pDiE4qWWIfGeMQcoctqYfNVf",
  "aud": "client-123",
  "acr": "urn:hopae:loa3",
  "amr": ["pin"],
  "hopae_loa": 3,
  "hopae_loa_label": "substantial",
  "auth_time": 1756200864,
  "iat": 1756200900,
  "exp": 1756201200
}
UserInfo
{
  "sub": "wPqH84Q4pDiE4qWWIfGeMQcoctqYfNVf",
  "acr": "urn:hopae:loa4",
  "amr": ["pin", "biometric"],
  "hopae_loa": 4,
  "hopae_loa_label": "high",
  "user": {
    "name": "Anders Eriksson",
    "email": "[email protected]"
  }
}

​
References

  • RFC 6711 – An IETF Registry for Level of Assurance (LoA) Profiles
  • IANA OIDC ACR Values Registry
  • OpenID Connect Core 1.0 (acr, amr, auth_time)
  • eIDAS 2.0; NIST 800‑63 (Digital Identity Guidelines)

​
TL;DR for developers

  • acr: URI (e.g., urn:hopae:loa3)
  • hopae_loa: integer (1–5) for simple checks
  • hopae_loa_label: human‑friendly text (e.g., substantial)
if (claims.hopae_loa >= 3) {
  // allow sensitive action
}