Login API checklist

API version: 2.0.

Integrate all of the required endpoints. For examples of requests and responses, see:

• Login API quick start guide
• Postman collection and environment.

If you're new to the platform, see Getting started for information about API keys, product activation, and the test environment.

Login API v2 checklist	Your comments
Endpoints to integrate
OpenID Connect (Get OIDC well-known endpoint) GET:/access-management-1.0/access/.well-known/openid-configuration
JSON Web Keys Discovery GET:/access-management-1.0/access/.well-known/jwks.json
The OAuth 2.0 authorize endpoint (Only required if using the Login in browser flow) GET:/access-management-1.0/access/oauth2/auth
The OAuth 2.0 token endpoint POST:/access-management-1.0/access/oauth2/token
CIBA authentication endpoint (Only required if using the Merchant initiated Login flow) POST:/vipps-login-ciba/api/backchannel/authentication
User exists endpoint (Only required if using the Merchant initiated Login flow) POST:/vipps-login-ciba/api/v1/user-exists
Quality assurance
Ensure functionality Verify that your solution works seamlessly across all browsers, including non-default mobile browsers (e.g., initiating login from Chrome on iOS).
Connect existing accounts Implement proper linking of the Vipps or MobilePay user to your own user registry. See recommendations on linking to user account.
Handle errors Make sure to log and handle all errors. For example, handle cancelled logins and error situations while redirecting the user back to redirect_uri (i.e., redirect with an error query parameter). In addition, display errors in a way that the users (customers and merchant employees/administrators) can see and understand them.
Avoid integration pitfalls
Use correct flow Native app integrations use the app-to-app flow. Merchant initiated login must not be used for web-based login.
Do not use embedded iFrames Integration with the Login API is redirect-based (i.e., do not use an embedded iFrame).
Set company name and logo The sales unit name appears on the Vipps MobilePay landing page. Both the name and logo appear in the Vipps or MobilePay app under Personal information > Companies with access. See how to change name and logo.
Whitelist redirect URIs Ensure that all redirect_uris for your integration have been added to the portal white list. See the FAQ for how to do this. Ensure that all URLs use HTTPS or native URL schemes (i.e., vipps://), not HTTP. ALL URLs must match the exact URI sent on /auth request. No query parameters or additional trailing / can be included.
Use only required scopes Request only the scopes that you require, no "nice to have" scopes. If using national identity number, you must be granted access to request these scopes. See FAQ for details.
Comply with our terms and conditions If you, as a merchant, will act on behalf of others (e.g., share data you have gotten from us with other merchants), ensure that you comply with our terms and conditions.
Follow design guidelines The branding must be according to the Design guidelines. Use the button generator.
Include standard HTTP headers Send the HTTP headers in all API requests for better tracking and troubleshooting (mandatory for partners and platforms, who must send these headers as part of the checklist approval).
Configure marketing consents (Only required if you are collecting marketing consents.) Ensure that you have the correct terms and conditions and privacy URL set up if you are collecting marketing consents.
Security
Generate a state parameter Ensure that a unique state parameter is generated for each /auth request.
Do not share client_secret Ensure that the client_secret is kept secret and is never be shared to browsers or native apps.

Information for partners

Partners, there are additional checklist items for you, as described in Partner checklist.

Partner checklist

Partner checklist	Your comments
Accept partner terms and conditions As a partner, you accept the Partner terms and conditions
Provide technical documentation for merchants How to apply for products (a URL, plain text or PDF is preferred) How to configure and use the solution (a URL, plain text or PDF is preferred) Frequently Asked Questions (FAQs) for merchants (a URL, plain text or PDF is preferred)
Pilot customer Provide one pilot customer to verify the integration in the production environment (send organization number and name).
Description of integration Describe how your integration has been set up, with a link to a demo, or provide screenshots (PDF is preferred).

Send your completed checklist to us at developer@vippsmobilepay.com.

Include examples from the test environment, pilot customer info, and a description of the implemented solution. Please provide a test access to your setup for us to try, or a video of the user flow. The video must include both a successful login flow and a failed login flow (where user rejects the login).

We will verify your integration and get back to you as soon as possible. After the checklist is approved, we'll send you the information you need to go live.

Flow to go live for direct integrations

1. Order Login.
2. We will complete customer control (KYC, PEP, AML, etc.). As soon as the customer control is completed, independently of this checklist, we will make the production API keys available on portal.vippsmobilepay.com and notify you that you can retrieve your keys.
3. Retrieve your API keys.
4. Complete all the checklist items.
5. Verify the integration in the test environment.
6. Verify the integration in the production environment:
7. Partners only: Send your checklist to developer@vippsmobilepay.com. We don't do any kind of activation or make any changes based on this checklist, we just use it to verify that you have done the integration.
8. Go live 🎉

tip

Operational Status Page

We recommend that you subscribe to the Vipps MobilePay Operational Status Page for real-time updates on service availability, incidents, and maintenance.