Register your application in the Login.gov partner portal to obtain a client ID; choose the IAL (Identity Assurance Level) appropriate to your service — IAL1 for self-asserted attributes, IAL2 for identity-verified users.
Fetch the OpenID Connect discovery document at https://secure.login.gov/.well-known/openid-configuration to obtain current endpoint URLs, supported scopes, and signing key metadata.
Redirect the user to https://secure.login.gov/openid_connect/authorize with parameters including client_id, response_type=code, scope, nonce, state, and acr_values encoding the requested IAL; Login.gov will authenticate the user and redirect back with an authorization code.
Exchange the authorization code for tokens by POSTing to https://secure.login.gov/api/openid_connect/token; Login.gov uses private_key_jwt for client authentication — sign an assertion with your private key and include it as client_assertion.
Validate the returned id_token: verify the signature using Login.gov's public keys from the JWKS URI, confirm the nonce matches, and check the iat and exp claims.
Use the access token to call https://secure.login.gov/api/openid_connect/userinfo to retrieve the user's verified attributes such as email, sub, and for IAL2 users, verified_at.
Known gotchas
Login.gov uses private_key_jwt client authentication, not a client secret — integrations expecting a client_secret_post or Basic auth client authentication method will fail at the token endpoint.
The sandbox environment uses a different base URL (idp.int.identitysandbox.gov) with separate keys and certificates; never mix sandbox client IDs with production endpoints or vice versa.
Login.gov's TLS certificates rotate periodically — pin to the certificate authority rather than the leaf certificate, and subscribe to Login.gov partner notifications to receive advance warning of rotation events.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp