> **Description:** Essential information and requirements you need to know before implementing the Login API.

# Important information

## Minimum age of user

To use Vipps or MobilePay for login, the user must be at least 15 years old.

## Best practices for linking user accounts

Logging in with Vipps  or  MobilePay gives a simple experience for the user.

Users who already have an account based on another login method can link this account to their Vipps/MobilePay user.
This will give them a better experience next time.

The following are guidelines for linking the user's existing account with their Vipps/MobilePay user:

- **Check if you already have the `sub`**
  First, check if you already have the unique user identifier for Vipps MobilePay (called `sub` in the response from our API)
  stored on one of your accounts. If you have it, this means that the user has used Vipps MobilePay on your site
  earlier and has an explicit link to the account. In this case, use the `sub` to log
  the user into their account.

  The `sub` does not change (except in very special cases).
  See: [What is the sub?](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md#sub)

- **Fallback to phone number and email address matching**
  If you have not already stored the `sub`, check if the user already has an account
  based on their phone number and email address. If this gives a match on one (and
  only one) account, then you can use this to log the user into that account since
  both phone number and email address are verified in Vipps MobilePay.

- **Perform a sanity check**
   Before completing the linking, compare the user's name from Vipps MobilePay with the name in the existing account.
   This ensures it is not an old account where the user has abandoned the phone number or
   email address and this has been picked up by someone else at a later time.

- **Handle multiple account matches**
   If you get a match on multiple accounts, you can provide information on this and
   offer the user the possibility to log in to their existing account (using the old
   login method) and then link the account to Vipps MobilePay.

- **Enable account linking from their account profile settings**
   Provide logged-in users with the option to link their profile to Vipps MobilePay on your website.
   This provides for an easier login next time.

   Just provide the *login with Vipps* or *login with MobilePay* buttons and link the `sub` from Vipps MobilePay with this account.

- **Account creation guidance**
   If the user does not have an existing account, but this is required for some reason
   (e.g. because you have a separate sign-up process or the users need to be an existing member/customer),
    you should provide the user with a message explaining the situation after Login has finished.
    If relevant, you should provide links or directions on how to create the required account.

By following these steps, you ensure a smoother integration process while providing flexibility for users.

## Using Login in native applications

Web views should not be used when using Login in a native application. Instead, the user should be redirected using an external browser opened by or within the app.

Android: Use [Custom Tabs](https://developer.chrome.com/multidevice/android/customtabs) or fallback to open external browser on user's device.

iOS: Use [SFAuthenticationSession](https://developer.apple.com/documentation/safariservices/sfauthenticationsession) (for iOS 11 and 12) or
[ASWebAuthenticationSession](https://developer.apple.com/documentation/authenticationservices/aswebauthenticationsession) (for iOS 13 and above).

## Revoking consent

Users can revoke their data sharing consent with merchants in the Vipps  or  MobilePay app,
under *Profile* > *Personal information*. After revoking, users must give consent again to log in or share data via Vipps MobilePay.

When consent is revoked, we send a `CONSENT_REVOKED` webhook event (including the user's sub) to the merchant's webhook server.

This feature is optional for merchants. It can be used to trigger events on the merchant's side. For example:

- Notify users they still have an account
- Suggest alternative login options
- Provide instructions for deleting stored data

For more information, see the [Revoke consent webhooks](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/webhooks.md#revoke-consent-webhooks) section.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).