SmaiID
V1 · AAL2
SH

Developers

Konsmik entities do not create universal identities. They trust SmaiID, receive a subject identifier, and keep their own local record against it.

Protocol endpoints

Stable OpenID Connect and OAuth surfaces, plus current OAuth security BCP.

Discovery

GET /.well-known/openid-configuration

JWKS

GET /.well-known/jwks.json

Authorization

GET /authorize

Token

POST /token

UserInfo

GET /userinfo

Revocation

POST /revoke

Introspection

POST /introspect

End session

GET /logout

Integration rules

Non-negotiable for any registered client.

  • Authorization Code with PKCE for every client type. No implicit flow.
  • Exact-match redirect URIs. No wildcards, no path prefixes.
  • ID tokens are JWS-signed; verify against JWKS and pin the issuer.
  • Request the narrowest scope set. Sensitive scopes require explicit consent each time they widen.
  • Never store a Konsmik-wide account. Store a local record keyed by the sub claim.
  • Honour token revocation and back-channel logout so sessions die everywhere at once.

Registered applications

Redirect URIs are exact-match only.

WaidesMai

kon_waidesmai_web · web · 4 scopes · https://waidesmai.konsmik.com/auth/callback

PRODUCTIONACTIVE

WaidTred

kon_waidtred_web · web · 6 scopes · https://waidtred.konsmik.com/auth/callback

PRODUCTIONACTIVE

Waides Akademi

kon_akademi_web · web · 4 scopes · https://akademi.konsmik.com/auth/callback

PRODUCTIONACTIVE

WaidSoko

kon_waidsoko_web · web · 4 scopes · https://waidsoko.konsmik.com/auth/callback

PRODUCTIONACTIVE

KonsDesk

kon_konsdesk_web · web · 4 scopes · https://konsdesk.konsmik.com/auth/callback

PRODUCTIONACTIVE

KI Market Compass

kon_kimarketcompass_web · spa · 3 scopes · https://compass-staging.konsmik.com/auth/callback

STAGINGPENDING

What an entity receives

Only approved claims. Never wallet, trading, message or cross-application data.

{
  "iss": "https://id.konsmik.com",
  "sub": "SID-H-7QK2-4M9T-XB13",
  "aud": "kon_akademi_web",
  "name": "Nwaora De Smai",
  "preferred_username": "@nwaora",
  "identity_type": "HUMAN",
  "verification_level": "V1",
  "trust_level": 2,
  "role": ["student"]
}

Not yet enforced: Client registration, key management, token issuance and introspection require the identity backend. This page documents the contract entities must build against.