​
Overview

hConnect offers two integration methods: Webview (OAuth 2.0/OIDC-based approach) and direct API integration. Each has distinct trade-offs in security, complexity, and control.

​
Architecture Comparison

​
OAuth 2.0 Authorization Code Flow

Follows OAuth 2.0/OIDC patterns for simplified yet secure integration:
OIDC Full Compliance Coming Soon: We’re actively working on making our Webview integration fully OIDC-compliant, which will provide even better standards compatibility and security features.
  1. Redirect users to hConnect
  2. hConnect handles all provider interactions
  3. Receive authorization code via redirect
  4. Exchange code for ID token

​
Key Security Features

  • PKCE: Protection against code interception
  • State Parameter: CSRF protection
  • Single-use codes: 60-second TTL
  • JWT ID Tokens: Standard token format

​
Implementation Example

// Authorization request with PKCE
const authUrl = new URL('https://sandbox.verify.hopae.com');
authUrl.searchParams.append('client_id', CLIENT_ID);
authUrl.searchParams.append('redirect_uri', REDIRECT_URI);
authUrl.searchParams.append('code_challenge', codeChallenge);
authUrl.searchParams.append('code_challenge_method', 'S256');

​
Provider Flow Comparison (Example)

ProviderFlow TypeWebview HandlingAPI Requirements
BankID SEQR Code✅ AutomaticQR generation + polling
MitID DKRedirect✅ AutomaticRedirect handling
Smart-IDPush✅ AutomaticPush UI + polling
DigiD NLRedirect✅ AutomaticMulti-step redirects
itsme BEQR + Push✅ AutomaticMulti-flow support
Provider Abstraction: Webview handles all provider complexities automatically. API integration requires implementing each provider’s specific flow.

​
Key Differences

AspectWebviewAPI
Security ModelOAuth 2.0 patterns with PKCECustom implementation
Provider ComplexityAbstracted awayDirect handling required
Implementation TimeQuick setupExtensive development
Control LevelStandard flowFull customization
MaintenanceAutomatic updatesManual updates

​
Next Steps

Webview Ingegration

Webview integration guide

API Ingegration

Direct API integration guide