Integrate Login.gov OIDC for a government service application

Steps

1. Register your application in the Login.gov partner portal to obtain a client ID; choose the IAL (Identity Assurance Level) appropriate to your service — IAL1 for self-asserted attributes, IAL2 for identity-verified users.
2. Fetch the OpenID Connect discovery document at https://secure.login.gov/.well-known/openid-configuration to obtain current endpoint URLs, supported scopes, and signing key metadata.
3. Redirect the user to https://secure.login.gov/openid_connect/authorize with parameters including client_id, response_type=code, scope, nonce, state, and acr_values encoding the requested IAL; Login.gov will authenticate the user and redirect back with an authorization code.
4. Exchange the authorization code for tokens by POSTing to https://secure.login.gov/api/openid_connect/token; Login.gov uses private_key_jwt for client authentication — sign an assertion with your private key and include it as client_assertion.
5. Validate the returned id_token: verify the signature using Login.gov's public keys from the JWKS URI, confirm the nonce matches, and check the iat and exp claims.
6. Use the access token to call https://secure.login.gov/api/openid_connect/userinfo to retrieve the user's verified attributes such as email, sub, and for IAL2 users, verified_at.