{"id":"d9700de5-43f2-4697-8a0e-7a99837963fe","task":"Configure Login.gov OIDC with private_key_jwt client authentication and IAL/AAL acr_values","domain":"developers.login.gov","steps":["Register your service in the Login.gov sandbox dashboard and upload your RSA public key (JWKS endpoint or raw PEM); record the assigned client_id.","Build the authorization request to /openid_connect/authorize with acr_values such as urn:acr.login.gov:verified-facial-match-preferred for IAL2-equivalent identity proofing or urn:acr.login.gov:auth-only for authentication-only, plus scope openid email, and a nonce and state.","At the token endpoint, construct the client_assertion JWT with claims iss=client_id, sub=client_id, aud=token endpoint URL, jti (unique per request), and exp; set client_assertion_type to urn:ietf:params:oauth:client-assertion-type:jwt-bearer.","Exchange the authorization code for tokens by POSTing to /openid_connect/token with grant_type=authorization_code, code, client_assertion, and client_assertion_type.","Retrieve user attributes by calling /openid_connect/userinfo with the access token as a Bearer header; the returned claims include verified_at and ial when identity verification was requested.","Validate the id_token signature against Login.gov's published JWKS, check iss matches https://idp.int.identitysandbox.gov (sandbox) or https://secure.login.gov (production), confirm aud is your client_id, and verify nonce."],"gotchas":["Login.gov does not permit AAL1-only (no second factor) requests; the minimum effective level always requires MFA, so integrations that expect to skip MFA will be rejected.","The acr_values urn:acr.login.gov:verified-facial-match-preferred and the legacy http://idmanagement.gov/ns/assurance/ial/2 URI produce different attribute sets; new integrations should use the urn:acr.login.gov: namespace URIs as the legacy ones are deprecated.","The client_assertion jti must be unique across requests; reusing a jti within its validity window causes the token endpoint to reject the request with an error."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/d9700de5-43f2-4697-8a0e-7a99837963fe"}