Register your service in the Login.gov sandbox dashboard and upload your RSA public key (JWKS endpoint or raw PEM); record the assigned client_id.
Build the authorization request to /openid_connect/authorize with acr_values such as urn:acr.login.gov:verified-facial-match-preferred for IAL2-equivalent identity proofing or urn:acr.login.gov:auth-only for authentication-only, plus scope openid email, and a nonce and state.
At the token endpoint, construct the client_assertion JWT with claims iss=client_id, sub=client_id, aud=token endpoint URL, jti (unique per request), and exp; set client_assertion_type to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
Exchange the authorization code for tokens by POSTing to /openid_connect/token with grant_type=authorization_code, code, client_assertion, and client_assertion_type.
Retrieve user attributes by calling /openid_connect/userinfo with the access token as a Bearer header; the returned claims include verified_at and ial when identity verification was requested.
Validate the id_token signature against Login.gov's published JWKS, check iss matches https://idp.int.identitysandbox.gov (sandbox) or https://secure.login.gov (production), confirm aud is your client_id, and verify nonce.
Known gotchas
Login.gov does not permit AAL1-only (no second factor) requests; the minimum effective level always requires MFA, so integrations that expect to skip MFA will be rejected.
The acr_values urn:acr.login.gov:verified-facial-match-preferred and the legacy http://idmanagement.gov/ns/assurance/ial/2 URI produce different attribute sets; new integrations should use the urn:acr.login.gov: namespace URIs as the legacy ones are deprecated.
The client_assertion jti must be unique across requests; reusing a jti within its validity window causes the token endpoint to reject the request with an error.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp