Federal ID Partners and developers
Sign people in with Federal ID, learn their verification level, and rely on signed statements you verify yourself. Sandbox first.
What you can do with the Federal ID
As a registered partner your service can:
- Sign people in with Federal ID. Plain OpenID Connect against the federation’s
citizensrealm. One account works across every Federal Africa service and every partner, and your login keeps working even if the identity registry is down. - Turn a login into a Federal ID. One call with the ID token you just received returns the person’s Federal ID, issuing one at Level 0 if they are new.
- Look up a Federal ID’s status. Level, status, member state, membership tier: no personal data, no consent needed.
- Receive signed assertions. With the member’s consent, OFIS signs the attributes you asked for; you verify the signature offline against the published keys and never call OFIS on your hot path.
- Be told when something changes. Webhooks for suspension, reactivation, level changes, revoked consent and membership changes.
- Report memberships you sell, if you are an app that sells plans: the tier and its end date, never the money.
OFIS never returns raw personal data: no names, documents, photographs, phone numbers or dates of birth. Everything you receive is public reference data or a non-personal status projection.
Sign in with Federal ID
| Environment | OpenID Connect issuer |
|---|---|
| Sandbox | https://sandbox-auth.federal.africa/realms/citizens |
| Production | https://auth.federal.africa/realms/citizens |
Discovery is at {issuer}/.well-known/openid-configuration. Use the authorization code flow with PKCE (S256); a confidential backend adds its client secret, a mobile or single-page app is a public client. Request openid email profile; the email scope is required for enrollment. Rely on sub (a stable account ID, not the Federal ID), email, email_verified, name and preferred_username. Tokens are RS256 against the realm JWKS. Your client must not use a pairwise subject mapper, because the Federal ID is keyed on the realm-wide sub.
The login page has a Register link, so sign-up is built in. Partner clients show a consent screen with your app’s name on first sign-in.
Signing in tells you who the person is. To get their Federal ID, call enrollment with the ID token. To get signed, offline-verifiable claims, send them through linking. Both are in the integration guide.
The environments
| Environment | API base URL |
|---|---|
| Sandbox | https://sandbox.identity.federal.africa |
| Production | https://identity.federal.africa |
Every partner starts in the sandbox, with eight fixture identities and a pre-seeded consumer client. Production credentials follow once integration testing passes. Sandbox details.