The simplified flow can be used for text signing and can be initiated by providing the sign scope and the text to be signed, i.e. sign_txt, as query parameters to the authorization request:

GET [authorize_endpoint]... &scope=sign&sign_txt=base64encoded(utf8-string)

The text to be signed must be base64 encoded and provided in the query parameter sign_txt.

The result contains the basic signatures of the merchant and end user, as well as the hash over the received text. The result is contained in the sign_result claim in the ID token.

Example sign_result claim in ID token:

"sign_result" : {
    "endUser" : "MIAGC...",
    "merchant" : "MIAGC...",
    "hash" : "4oK3g..."
}

Sequence diagram

BankID on mobile for text signing

See Document and Text Signing for details and limitations when using BankID on mobile for signing.

Tip: Utility code for base64 in javascript

// Format a string str such that it may be used as the sign_txt value
function b64EncodeUnicode(str) {
    // use encodeURIComponent to get %-encoded UTF-8,
    // convert these encodings into raw bytes
    // feed the bytes btoa.
    return btoa(encodeURIComponent(str).replace(/%([0-9A-F]{2})/g,
        function toRawBytes(match, p1) {
            return String.fromCharCode('0x' + p1);
        }));
}
 
 
function b64DecodeUnicode(str) {
    // This is the inverse of b64EncodeUnicod; from bytestream, to %-encoding, to original string.
    return decodeURIComponent(atob(str).split('').map(function(c) {
        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
    }).join(''));
}
 
 
// Computes the sha 256 of the given string, then converts the result to a b64 string
// The result is directly comparable to the hash: value in a sign_result: in id_token.
// idToken.signresult.hash === await computeSha256AsB64FromUtf8("original String to be signed")
//
function computeSha256AsB64FromUtf8(str) {
    var buffer = new TextEncoder().encode(str);
    return crypto.subtle.digest("SHA-256", buffer).then(function (hash) {
        return btoa(String.fromCharCode.apply(null, new Uint8Array(hash)));
    });
}

LATEST CURRENT (OIDC)

Simple flow implementation guide

Analytics

Sequence diagram

BankID on mobile for text signing

Tip: Utility code for base64 in javascript

Related content