{"id":"3f395db1-03cb-4a9f-a612-b3bb0084f013","task":"Implement ID.me attribute exchange to retrieve community group membership for benefit eligibility gating","domain":"developers.id.me","steps":["Configure an ID.me application in the developer portal with the Attribute Exchange policy for the specific group type (military, veteran, first responder, student, or low-income); each group type requires a separate policy scope.","Initiate the OIDC flow with scope openid and the specific community scope (e.g., military, veteran); the user completes group verification on ID.me's hosted interface.","On callback, exchange the authorization code for tokens; call the userinfo endpoint with the access token to retrieve the group claim, which returns the verified affiliation and the verification method used.","Map the group attribute to your benefit eligibility logic: a truthy group claim confirms the user belongs to the asserted community; a missing or false claim indicates verification was not completed or group membership was not established.","Cache the group verification result with an expiry aligned to ID.me's verification validity period (typically one year for document-based verifications); trigger re-verification on expiry rather than storing the claim indefinitely.","Handle partial verification: a user may successfully authenticate (openid scope claims present) but fail community verification (group claim absent); display a clear message that benefit access requires completed group verification."],"gotchas":["ID.me community verification and identity verification (IAL2-equivalent) are separate products with separate scopes and policies; requesting only a community scope does not guarantee that the underlying identity has been proofed to IAL2 level.","Group verification evidence types differ by community: military verification can use DMDC database lookup, .mil email, or DEERS matching, while student verification may use institutional email or NSLDS; the verification method affects the reliability of the resulting claim.","ID.me enforces rate limits on the token and userinfo endpoints; high-throughput applications should implement token caching using the refresh token rather than forcing re-authentication on every session."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/3f395db1-03cb-4a9f-a612-b3bb0084f013"}