> For the complete documentation index, see [llms.txt](https://docs.inji.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inji.io/inji-wallet/inji-mobile/technical-overview/backend-services/login-using-credential.md).
# Authorization Server for Authentication Using Inji Wallet Credentials
## Overview
**Online Login** enables users to securely access digital services using a verifiable credential stored in the Inji Wallet. Instead of using traditional usernames and passwords, users can authenticate themselves by presenting a trusted digital credential, completing user verification, and consenting to share only the required information with the service provider.
***
## Example Use Case
This use case is applicable to any service provider portal that supports wallet-based authentication through a compatible Authorization Server (AS).
The following example demonstrates the online login flow within the Inji ecosystem using **eSignet** as the Authorization Server.
* **Authorization Server (AS):** eSignet
* **Service Provider:** Health ID Services Portal
* **Credential Issuer:** Republic of Veridonia National ID Department
* **Credential:** Veridonia National ID
In this example, a user downloads the Veridonia National ID credential into the Inji Wallet and later uses it to securely sign in to the Health ID Services Portal.
***
## User Journey
1. Open the **Inji Wallet** application.
2. Tap the **+** button and download a credential from the **Republic of Veridonia National ID Department**.
3. After the credential is downloaded, open the credential menu (⋮) and activate it.
4. Open the **Health ID Services** portal and select **Sign in with eSignet**.
5. A QR code is displayed on the portal. Using the Inji Wallet, scan the QR code from the **Share** tab or the credential's **QR Login** option.
6. Complete the face authentication.
7. Review the requested claims and choose the information to share.
8. Provide consent.
9. The requested claims are securely shared, and the user is successfully signed in to the Health ID Services portal.
***
## APIs Involved
The user is required to open the portal integrated with eSignet and utilize the app scanner to scan the QR code.
### Link Login Transaction
After successfully scanning the QR code, Inji Wallet will access the API below and transmit the link code.
## Link Transaction endpoint V2
> The link transaction endpoint is invoked from Wallet-app.\
> \
> 1\. Validates the link-code and its expiry and generates the linkTransactionId. This linkTransactionId is linked to transactionId returned from /oauth-details endpoint.\
> \
> 2\. Returns the auth-factors, clientName, logoUrl, User claims, authorize scopes along with linkTransactionId.\
> \
> \*\*Note:\*\*\
> Wallet-app will hereafter address the transaction with this linkTransactionId for the /authenticate and /consent endpoints.
```json
{"openapi":"3.1.0","info":{"title":"e-Signet","version":"1.0"},"tags":[],"servers":[{"url":"https://esignet.collab.mosip.net/v1/esignet"}],"paths":{"/linked-authorization/v2/link-transaction":{"post":{"summary":"Link Transaction endpoint V2","operationId":"post-authorization-link-transaction-v2","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"responseTime":{"type":"string"},"response":{"type":"object","properties":{"linkTransactionId":{"type":"string","description":"Unique link-transaction-id."},"clientName":{"type":"object","description":"OIDC client name in different languages where language is the key and client name\nis the value. Default name is passed in @none key."},"logoUrl":{"type":"string","description":"Registered OIDC client Logo URL."},"authorizeScopes":{"type":"array","description":"List of requested scopes to be permitted by the end user.","items":{"type":"string"}},"essentialClaims":{"type":"array","description":"List of client request mandatory claim names.","items":{"type":"string"}},"voluntaryClaims":{"type":"array","description":"List of client request optional claim names.","items":{"type":"string"}},"authFactors":{"type":"array","description":"Auth factors defines the authentication screens displayed in IDP frontend. More than one authFactor may be resolved or combination of auth factors. Precedence of authFactors is based on its order","items":{"type":"array","items":{"$ref":"#/components/schemas/AuthFactor"}}},"configs":{"type":"object"},"credentialScopes":{"type":"array","description":"List of valid credential scopes requested","items":{"type":"string"}}}},"errors":{"type":"array","items":{"type":"object","properties":{"errorCode":{"type":"string","enum":["invalid_link_code","invalid_transaction","invalid_client_id","unknown_error"]},"errorMessage":{"type":"string"}}}}}}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"requestTime":{"type":"string"},"request":{"type":"object","required":["linkCode"],"properties":{"linkCode":{"type":"string","description":"Link code as received by the wallet-app from the QR code scanning."}}}},"required":["requestTime","request"]}}}},"description":"The link transaction endpoint is invoked from Wallet-app.\n\n1. Validates the link-code and its expiry and generates the linkTransactionId. This linkTransactionId is linked to transactionId returned from /oauth-details endpoint.\n\n2. Returns the auth-factors, clientName, logoUrl, User claims, authorize scopes along with linkTransactionId.\n\n**Note:**\nWallet-app will hereafter address the transaction with this linkTransactionId for the /authenticate and /consent endpoints.","tags":["WALLET"]}}},"components":{"schemas":{"AuthFactor":{"title":"AuthFactor","type":"object","properties":{"type":{"type":"string","description":"Name of the authentication method","enum":["PIN","OTP","L1-bio-device","Wallet","KBA"]},"count":{"type":"integer","description":"Applicable for biometric based authentication, number of bio segments to be captured for authentication."},"bioSubTypes":{"type":"array","description":"Applicable for biometric based authentication. Can be more specific about which bio segments should be captured.","items":{"type":"string"}}},"required":["type"]}}}}
```
### Authenticate User
After successful face authentication, the wallet authenticates the user.
## Linked Authentication Endpoint V2
> Once end user provides the user identifier (UIN/VID) and all the required auth challenge to the Wallet-app, this endpoint will be invoked from wallet-app.\
> \
> Supported auth-challenge depends on the integrated authentication server.\
> \
> 1\. Validates linkedTransactionId.\
> 2\. Validates null / empty individualId.\
> 4\. Invokes kyc-auth call to integrated authentication server (IDA).\
> 5\. Relays error from integrated authentication server to UI on failure.\
> 6\. It validates stored userconsent against the requested claims and scopes\
> \
> On Authentication Success: linkTransactionId and consentAction is returned in the below response without any errors.\
> \
> On Authentication Failure: Error list will be set with the errors returned from the integrated authentication server.
```json
{"openapi":"3.1.0","info":{"title":"e-Signet","version":"1.0"},"tags":[],"servers":[{"url":"https://esignet.collab.mosip.net/v1/esignet"}],"paths":{"/linked-authorization/v2/authenticate":{"post":{"summary":"Linked Authentication Endpoint V2","operationId":"post-linked-authenticate-v2","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"responseTime":{"type":"string"},"response":{"type":"object","properties":{"linkedTransactionId":{"type":"string","description":"This is the same transactionId sent in the oauth-details response."},"consentAction":{"type":"string","enum":["CAPTURE","NOCAPTURE"],"description":"This field indicates the need to capture user consent or not\n"}}},"errors":{"type":"array","description":"List of Errors in case of request validation / processing failure in Idp server.","items":{"type":"object","properties":{"errorCode":{"type":"string","enum":["invalid_transaction_id","invalid_transaction","invalid_identifier","invalid_no_of_challenges","auth_failed","unknown_error"]},"errorMessage":{"type":"string"}}}}}}}}}},"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"requestTime":{"type":"string","pattern":"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"},"request":{"type":"object","required":["linkedTransactionId","individualId","challengeList"],"properties":{"linkedTransactionId":{"type":"string","description":"This is the same transactionId sent in the link-transaction response."},"individualId":{"type":"string","description":"User identifier (UIN/VID)."},"challengeList":{"type":"array","description":"Authentication Challenge.","items":{"$ref":"#/components/schemas/AuthChallenge"}}}}},"required":["requestTime","request"]}}},"description":""},"description":"Once end user provides the user identifier (UIN/VID) and all the required auth challenge to the Wallet-app, this endpoint will be invoked from wallet-app.\n\nSupported auth-challenge depends on the integrated authentication server.\n\n1. Validates linkedTransactionId.\n2. Validates null / empty individualId.\n4. Invokes kyc-auth call to integrated authentication server (IDA).\n5. Relays error from integrated authentication server to UI on failure.\n6. It validates stored userconsent against the requested claims and scopes\n\nOn Authentication Success: linkTransactionId and consentAction is returned in the below response without any errors.\n\nOn Authentication Failure: Error list will be set with the errors returned from the integrated authentication server.","parameters":[],"tags":["WALLET"]}}},"components":{"schemas":{"AuthChallenge":{"title":"AuthChallenge","type":"object","description":"Model to take any type of challenge from the end user as part of authenticate request.","properties":{"authFactorType":{"type":"string","description":"Defines the type of auth challenge. It should be same as authfactor.type (oauth-details response).","enum":["OTP","BIO","PIN","WLA","PWD","KBA"]},"challenge":{"type":"string","description":"Actual challenge as string."},"format":{"type":"string","description":"Format of the challenge provided.","enum":["alpha-numeric","jwt","encoded-json","number","base64url-encoded-json"]}},"required":["authFactorType","challenge","format"]}}}}
```
### Submit User Consent
Once the user approves the requested claims, the wallet submits the consent.
## Linked Consent Endpoint V2
> Once the authentication is successful and user consent is obtained, this endpoint will be invoked by the wallet app to send the accepted consent and permitted scopes.\
> \
> 1\. Validates linkedTransactionId.\
> 2\. Validate accepted claims and permitted scopes in the request and the signature.\
> 3\. If valid, stores the accepted claims, permitted scopes and signature in the consent registry.
```json
{"openapi":"3.1.0","info":{"title":"e-Signet","version":"1.0"},"tags":[],"servers":[{"url":"https://esignet.collab.mosip.net/v1/esignet"}],"paths":{"/linked-authorization/v2/consent":{"post":{"summary":"Linked Consent Endpoint V2","operationId":"post-linked-consent-v2","description":"Once the authentication is successful and user consent is obtained, this endpoint will be invoked by the wallet app to send the accepted consent and permitted scopes.\n\n1. Validates linkedTransactionId.\n2. Validate accepted claims and permitted scopes in the request and the signature.\n3. If valid, stores the accepted claims, permitted scopes and signature in the consent registry.\n","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"requestTime":{"type":"string","pattern":"yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"},"request":{"type":"object","required":["linkedTransactionId"],"properties":{"linkedTransactionId":{"type":"string","description":"Transaction id echoed starting from /authorize call."},"permittedAuthorizeScopes":{"type":"array","description":"List of permitted scopes by end-user.","items":{"type":"string"}},"acceptedClaims":{"type":"array","description":"List of accepted essential and voluntary claims by end-user.","items":{"type":"string"}},"signature":{"type":"string","description":"Signature of permittedscopes and acceptedclaims from inji"}}}},"required":["requestTime","request"]}}}},"parameters":[],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"responseTime":{"type":"string"},"response":{"type":"object","properties":{"linkedTransactionId":{"type":"string","description":"This is the same transactionId sent in the link-transaction response."}}},"errors":{"type":"array","items":{"type":"object","properties":{"errorCode":{"type":"string","enum":["invalid_transaction_id","invalid_transaction","invalid_accepted_claim","invalid_permitted_scope"]},"errorMessage":{"type":"string"}}}}}}}}}},"tags":["WALLET"]}}}}
```
***
## Benefits
* Passwordless authentication using digital credentials.
* User-controlled sharing of identity attributes.
* Explicit consent before any information is shared.
* Reusable across multiple service provider portals.
* Secure authentication using trusted verifiable credentials.
***
## Reference
For details about the Wallet Authentication APIs, refer to the [eSignet Wallet Authenticator documentation](https://docs.esignet.io/esignet-authentication/develop/integration/wallet/wallet-authenticator#wallet-authentication-apis)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.inji.io/inji-wallet/inji-mobile/technical-overview/backend-services/login-using-credential.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.