Skip to main content

​
Overview

hConnect offers two integration methods: a hosted OIDC flow (redirect to Hopae’s OpenID Provider) and direct API integration. Each has distinct trade-offs in security, complexity, and control.

​
Architecture Comparison

  • Hosted OIDC Flow
  • REST API (Direct Integration)

​
OAuth 2.0 Authorization Code Flow

Follows the standard OIDC Authorization Code flow for simplified yet secure integration:
Fully OIDC-Compliant: The hosted flow uses the OIDC Authorization Code grant (with PKCE support) against the https://connect.hopae.com issuer, so you can reuse any OIDC-certified client library.
  1. Redirect users to https://sandbox.connect.hopae.com/auth (or production)
  2. hConnect handles all provider interactions
  3. Receive an authorization code on your redirect URI
  4. Exchange code for ID token

​
Key Security Features

  • PKCE: Protection against code interception
  • State Parameter: CSRF protection
  • Single-use codes: 60-second TTL
  • JWT ID Tokens: Standard token format

​
Implementation Example

const authUrl = new URL('https://sandbox.connect.hopae.com/auth');
authUrl.searchParams.append('client_id', CLIENT_ID);
authUrl.searchParams.append('redirect_uri', REDIRECT_URI);
authUrl.searchParams.append('response_type', 'code');
authUrl.searchParams.append('scope', 'openid profile');
authUrl.searchParams.append('state', crypto.randomUUID());
authUrl.searchParams.append('code_challenge', codeChallenge);
authUrl.searchParams.append('code_challenge_method', 'S256');

​
Provider Flow Comparison (Example)

ProviderFlow TypeHosted OIDC FlowAPI Requirements
BankID SEQR Code✅ AutomaticQR generation + polling
MitID DKRedirect✅ AutomaticRedirect handling
Smart-IDPush✅ AutomaticPush UI + polling
DigiD NLRedirect✅ AutomaticMulti-step redirects
itsme BEQR + Push✅ AutomaticMulti-flow support
Provider Abstraction: The hosted OIDC flow abstracts provider differences. Direct API integration requires implementing each provider’s specific flow.

​
Key Differences

AspectHosted OIDC FlowAPI
Security ModelOAuth 2.0 patterns with PKCECustom implementation
Provider ComplexityAbstracted awayDirect handling required
Implementation TimeQuick setupExtensive development
Control LevelStandard flowFull customization
MaintenanceAutomatic updatesManual updates

​
Next Steps

OIDC Integration

Hosted OIDC flow guide

API Integration

Direct API integration guide