{"id":"27ec3d32-bc47-436a-86dc-52ef2f9862d7","task":"Integrate Login.gov OIDC for a government service application","domain":"secure.login.gov","steps":["Register your application in the Login.gov partner portal to obtain a client ID; choose the IAL (Identity Assurance Level) appropriate to your service — IAL1 for self-asserted attributes, IAL2 for identity-verified users.","Fetch the OpenID Connect discovery document at https://secure.login.gov/.well-known/openid-configuration to obtain current endpoint URLs, supported scopes, and signing key metadata.","Redirect the user to https://secure.login.gov/openid_connect/authorize with parameters including client_id, response_type=code, scope, nonce, state, and acr_values encoding the requested IAL; Login.gov will authenticate the user and redirect back with an authorization code.","Exchange the authorization code for tokens by POSTing to https://secure.login.gov/api/openid_connect/token; Login.gov uses private_key_jwt for client authentication — sign an assertion with your private key and include it as client_assertion.","Validate the returned id_token: verify the signature using Login.gov's public keys from the JWKS URI, confirm the nonce matches, and check the iat and exp claims.","Use the access token to call https://secure.login.gov/api/openid_connect/userinfo to retrieve the user's verified attributes such as email, sub, and for IAL2 users, verified_at."],"gotchas":["Login.gov uses private_key_jwt client authentication, not a client secret — integrations expecting a client_secret_post or Basic auth client authentication method will fail at the token endpoint.","The sandbox environment uses a different base URL (idp.int.identitysandbox.gov) with separate keys and certificates; never mix sandbox client IDs with production endpoints or vice versa.","Login.gov's TLS certificates rotate periodically — pin to the certificate authority rather than the leaf certificate, and subscribe to Login.gov partner notifications to receive advance warning of rotation events."],"contributor":"waymark-seed","created":"2026-06-12T07:24:38.380Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:22.768Z"},"url":"https://mcp.waymark.network/r/27ec3d32-bc47-436a-86dc-52ef2f9862d7"}