This tab supports organizations that use OpenID Connect (OIDC) authorization protocols with the Incode Platform. You can view information about your existing OIDC authorization protocols from this tab.
Expand for descriptions of fields shown as columns in the OIDC list
| field | Description |
|---|---|
| Name | Shows the protocol name. |
| Client ID | Displays the client identifier (ID) generated by Incode. |
| Auth Methods | Displays one or more of these values based on the selections made when the protocol was generated: client secret basic, client secret post, client secret jwt, private key jwt, or none |
| Auth Grant Types | Displays one or more of these values based on the selections made when the protocol was generated: authorization code, refresh token, client credentials |
| Authentication Type | Displays one or more of these values based on the selections made when the protocol was generated: Face authentication, Onboarding, IncodeID, or Okta |
| Login Hint Type | Contains one of these values depending on the selections made when the protocol was generated: None, Unique ID, Phone, Email, or National Number |
| Login Attempt Limit | Displays the number of times a user can attempt to log in. The default and minimum value is 1 and the maximum value is 10 . |
| Redirect URIs | Shows one or more URIs users are redirected to for OIDC authentication. |
| Post Redirect URIs | Shows one or more URIs users are redirected to after their OIDC authentication is complete. |
| Scopes | Displays one or more of the scopes for which this protocol is used, based on the selections made when the protocol was generated.: openid, profile, email, address, selfie, selfie_attestation, fr_attestation, id_attestation, incode_id, roles, or scoring_results |
| Settings | Displays one or more settings for this protocol, based on the selections made when the protocol was generated: require-authorization-consent or require-proof-key |
| Authentication Signing Algorithm | Contains one of these values depending on the selection made when the protocol was generated: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, or PS512 |
| JWK Set URL | Shows the URL for a JWK set. |
| Actions | Provides icons so you can Edit or Delete the protocol. |
On the Authorization tab, you can also:
- Generate new authorization protocols
- Edit existing protocols
- Delete existing protocols
Generate New Authorization Protocol
Expand for descriptions of fields included in this task
| field | Description |
|---|---|
| ConfigurationName | Allows you to enter the protocol name. |
| Issuer URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Authorize URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Token URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Client ID | Displays the client identifier (ID) generated by Incode. You cannot edit this field, but you can copy the ID. |
| Client Secret | Displays a secure secret generated by Incode. You cannot edit this secret, but you can copy the secret shown. You can also click Generate to create an entirely new secret. |
| Authentication Type | Drop-down of authentication types that can be supported with an OIDC protocol. Selections in this field may dynamically add fields when you are generating a new protocol: Face authentication adds Login Hint Type, Enable Sign Up Flow, and Login Attempt Limit. Selecting Enable Sign Up Flow dynamically adds Flow Type, which then adds Flow or Workflow. Onboarding adds Flow Type, which then adds Flow or Workflow; Okta Issue URL; and Okta API Token. IncodeID does not add any fields. Okta adds Registration ID. |
| Login Hint | Drop-down of the following login hint values supported with an OIDC protocol: None, Unique ID, Phone, Email, or National Number. |
| Enable Sign Up Flow | Appears only when Authentication Type is set to Face Authentication. When selected, the Flow Type field displays. |
| Login Attempt Limit | Appears only when Authentication Type is set to Face Authentication. It lets you specify the number of times a user can attempt to log in. The default and minimum value is 1 and the maximum value is 10. |
| Flow Type | Allows you to select whether you want to use a Flow or a Workflow for this protocol. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Signup Flow is selected, and Flow Type is set to Workflow. Authentication Type is set to Onboarding. |
| Flow | Allows you to select from a drop-down of your existing Flows. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Sign Up Flow is selected, and Flow Type is set to Flow. Authentication Type is set to Onboarding and Flow Type is set to Flow. |
| Workflow | Allows you to select from a drop-down of your existing Workflows. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Sign Up Flow is selected, and Flow Type is set to Workflow. Authentication Type is set to Onboarding and Flow Type is set to Workflow. |
| Okta Issue URL | Appears only when Authentication Type is set to Onboarding. |
| Okta API Token | Appears only when Authentication Type is set to Onboarding. |
| Registration ID | Appears only when Authentication Type is set to Okta. |
| Redirect URIs | Allows you to enter one or more URIs to which users are redirected for OIDC authentication. |
| Post Logout Redirect URIs | Allows you to enter one or more URIs to which users are redirected after their OIDC authentication is complete. |
| Client Authentication Methods | Allows you to select or clear one or more of the following values when you create or edit a protocol: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, or none. |
| Authorization Grant Types | Allows you to select or clear one or more of the following values when you create or edit a protocol: authorization_code (this type is selected by default and cannot be cleared), refresh_token, or client_credentials. |
| Scopes | Allows you to define one or more of these supported scopes for which this protocol will be used: openid (this scope is selected by default and cannot be cleared), profile, email, address, phone, selfie, selfie_attestation, fr_attestation, id_attestation, incode_id, roles, and scoring_results. |
| Settings | Allows you to define one or more of these settings for this protocol: require-authorization-consent and require-proof-key. |
| Token Endpoint Authentication Signing Algorithm | Drop-down of the following supported signing algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, and PS512. |
| JWK Set URL | Allows you to enter the URL for a JWK set. |
| Authorize Generated URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
- In the left menu, click Configuration.
- Click the Authorization tab.
- Click Generate New in the lower right corner to open the Client Configuration dialog.
- Enter a Configuration Name.
- Select an Authentication Type from the drop-down of supported types. Your selection may cause additional fields to appear in the dialog. Refer to the table in the drop-down above for descriptions of these fields.
- Enter one or more valid Redirect URIs.
- Enter one or more valid Post Logout Redirect URIs if applicable.
- Select the checkboxes for any Client Authentication Methods this protocol will support.
- Select the checkboxes for any Authorization Grant Types this protocol will support.
- Select the checkboxes for the Scopes this protocol will support.
- Select the checkboxes for the Settings this protocol will support.
- Use the drop-down to select a supported Token Endpoint Authentication Signing Algorithm if applicable.
- Enter a valid JWK Set URL if applicable.
- When you are finished with your configuration, click Save.
Edit Existing Authorization Protocol
Expand for descriptions of fields included in this task
| field | Description |
|---|---|
| ConfigurationName | Allows you to enter the protocol name. |
| Issuer URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Authorize URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Token URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Client ID | Displays the client identifier (ID) generated by Incode. You cannot edit this field, but you can copy the ID. |
| Client Secret | Displays a secure secret generated by Incode. You cannot edit this secret, but you can copy the secret shown. You can also click Generate to create an entirely new secret. |
| Authentication Type | Drop-down of authentication types that can be supported with an OIDC protocol. Selections in this field may dynamically add fields when you are generating a new protocol: Face authentication adds Login Hint Type, Enable Sign Up Flow, and Login Attempt Limit. Selecting Enable Sign Up Flow dynamically adds Flow Type, which then adds Flow or Workflow. Onboarding adds Flow Type, which then adds Flow or Workflow; Okta Issue URL; and Okta API Token. IncodeID does not add any fields. Okta adds Registration ID. |
| Login Hint | Drop-down of the following login hint values supported with an OIDC protocol: None, Unique ID, Phone, Email, or National Number. |
| Enable Sign Up Flow | Appears only when Authentication Type is set to Face Authentication. When selected, the Flow Type field displays. |
| Login Attempt Limit | Appears only when Authentication Type is set to Face Authentication. It lets you specify the number of times a user can attempt to log in. The default and minimum value is 1 and the maximum value is 10. |
| Flow Type | Allows you to select whether you want to use a Flow or a Workflow for this protocol. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Signup Flow is selected, and Flow Type is set to Workflow. Authentication Type is set to Onboarding. |
| Flow | Allows you to select from a drop-down of your existing Flows. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Sign Up Flow is selected, and Flow Type is set to Flow. Authentication Type is set to Onboarding and Flow Type is set to Flow. |
| Workflow | Allows you to select from a drop-down of your existing Workflows. This field appears only when one of the following is met: Authentication Type is set to Face Authentication, Enable Sign Up Flow is selected, and Flow Type is set to Workflow. Authentication Type is set to Onboarding and Flow Type is set to Workflow. |
| Okta Issue URL | Appears only when Authentication Type is set to Onboarding. |
| Okta API Token | Appears only when Authentication Type is set to Onboarding. |
| Registration ID | Appears only when Authentication Type is set to Okta. |
| Redirect URIs | Allows you to enter one or more URIs to which users are redirected for OIDC authentication. |
| Post Logout Redirect URIs | Allows you to enter one or more URIs to which users are redirected after their OIDC authentication is complete. |
| Client Authentication Methods | Allows you to select or clear one or more of the following values when you create or edit a protocol: client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, or none. |
| Authorization Grant Types | Allows you to select or clear one or more of the following values when you create or edit a protocol: authorization_code (this type is selected by default and cannot be cleared), refresh_token, or client_credentials. |
| Scopes | Allows you to define one or more of these supported scopes for which this protocol will be used: openid (this scope is selected by default and cannot be cleared), profile, email, address, phone, selfie, selfie_attestation, fr_attestation, id_attestation, incode_id, roles, and scoring_results. |
| Settings | Allows you to define one or more of these settings for this protocol: require-authorization-consent and require-proof-key. |
| Token Endpoint Authentication Signing Algorithm | Drop-down of the following supported signing algorithms: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, and PS512. |
| JWK Set URL | Allows you to enter the URL for a JWK set. |
| Authorize Generated URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
- In the left menu, click Configuration.
- Click the Authorization tab.
- In the OIDC Authorization table, locate the protocol you want, scroll to the Actions column on the far right, and click Edit.
- Edit the fields and settings as needed.
- When you are finished with your changes, click Save.
Delete Existing Authorization Protocol
- In the left menu, click Configuration.
- Click the Authorization tab.
- In the OIDC Authorization table, locate the protocol you want, scroll to the Actions column on the far right, and click Delete.
- In the confirmation dialog, click Confirm.