BankID — Auth flow
Start an order, render the rolling QR, poll until the user signs in.
The BankID auth flow has three phases: start, render, collect.
1. Start the order
curl -X POST https://sandbox-api.cerrtify.com/service/bankid/auth \
-H "X-API-Key: cert_..." \
-H "Content-Type: application/json" \
-d '{
"endUserIp": "192.168.0.1",
"userVisibleData": "Sign in to Acme"
}'Response:
{
"orderRef": "131daac9-16c6-4618-beb0-365768f37288",
"autoStartToken": "7c40b5c9-fa74-49cf-b98c-bfe651f9a7c6",
"qrStartToken": "67df3917-fa0d-44e5-b327-edcc928297f8",
"qrStartSecret": "d28db9a7-4cde-429e-a983-359be676944c"
}Persist the orderRef server-side, scoped to the user session.
2. Render the rolling QR
The QR payload changes every second. Don't compute the HMAC yourself — call the proxy from your backend:
curl "https://sandbox-api.cerrtify.com/service/bankid/qr-code?orderRef=<orderRef>" \
-H "X-API-Key: cert_..."Response:
{ "qrData": "bankid.67df3917-fa0d-44e5-b327-edcc928297f8.0.dee5cd3f..." }Poll this every ~1s and re-render the QR from qrData. After the user scans, the BankID app takes over. Details, errors and a code example: BankID — QR code.
3. Poll for completion
curl -X POST https://sandbox-api.cerrtify.com/service/bankid/collect \
-H "X-API-Key: cert_..." \
-H "Content-Type: application/json" \
-d '{"orderRef":"<orderRef>"}'Statuses:
pending— keep polling (every 2s recommended).complete— done. The response includescompletionDatawith the user's PNR, name, IP, etc.failed— the user canceled or the order timed out. Stop polling.
4. Cancel (optional)
If the user navigates away, cancel the order:
curl -X POST https://sandbox-api.cerrtify.com/service/bankid/cancel \
-H "X-API-Key: cert_..." \
-H "Content-Type: application/json" \
-d '{"orderRef":"<orderRef>"}'Test personnummer (sandbox only)
In sandbox, click Aktivera BankID i sandbox in the dashboard first; that adds Cerrtify's test certificate, which runs against BankID's test environment. You need a test BankID — the BankID app configured for test plus a test user — a real BankID does not work there. See the BankID test instructions and Environments.