Authorization request parameters

What this page is

A single reference for every parameter LuxID accepts on the authorization endpoint (/mga/sps/oauth/oauth20/authorize), so you do not have to reassemble it from the flow, MFA, and language pages. For the step-by-step flow that uses these parameters, see OpenID Connect; for how the values are chosen and validated, follow the links in the notes.

LuxID uses the Authorization Code flow with PKCE (S256) only. The Implicit flow is not supported.

Required parameters

Parameter	Value	Notes
response_type	code	Only code (and none, for silent session checks) is supported. Implicit (id_token) is not supported.
client_id	your client identifier	Issued by POST Luxembourg at application registration.
redirect_uri	a registered callback URL	Must match a registered value exactly (HTTPS; no wildcards). See Redirect URIs and domains.
scope	space-separated scopes, including openid for OIDC	openid is required to receive an ID Token. Request only the scopes you need.
state	unique, unpredictable, single-use value	You generate it and must validate it on the callback (CSRF protection). See the Integration security checklist.
code_challenge	BASE64URL(SHA256(code_verifier))	PKCE is required for all clients (public and confidential).
code_challenge_method	S256	The plain method is not supported.

nonce is required in practice for OIDC sign-in even though the spec lists it as optional - see below.

Optional parameters

Parameter	Value	Notes
nonce	unique, unpredictable, single-use value	Strongly recommended for all OIDC sign-ins. LuxID reflects it into the ID Token; you must validate it to prevent token replay.
acr_values	urn:luxid:acr:level:low | substantial | high	Requested minimum assurance level, canonical form symmetric with the response acr claim. The exact accepted values are agreed per Partner during onboarding. See Authentication levels.
prompt	none | login | consent	Controls login UI behaviour - see the table below. select_account is not applicable (LuxID is a single-account IdP).
max_age	seconds	Maximum acceptable age of the authentication. If the existing auth_time is older, LuxID forces re-authentication. Verify auth_time in the returned ID Token.
login_hint	the user's email address	Pre-fills the email field on the login page.
id_token_hint	a previously issued ID Token	Used with prompt=none to indicate which user's session to check.
lang	fr | de | en | lu	Preferred login-page language. This is a LuxID-specific parameter, not the OIDC ui_locales (which LuxID does not use). Note the value for Luxembourgish is lu, even though the BCP 47 code is lb.
response_mode	query | fragment | form_post	How the response is delivered to your redirect_uri. Default is query for response_type=code. Use fragment for SPAs; form_post returns an auto-submitting form.

On language

LuxID controls the login-page language through the lang query parameter above, not through the standard OIDC ui_locales parameter. If you send ui_locales, it has no effect; send lang with one of fr, de, en, lu.

prompt values in detail

Value	Behaviour
none	No UI at all. LuxID returns an error if authentication or consent would be needed. Use it (in a hidden iframe, with id_token_hint) to check silently whether a LuxID session exists.
login	Force re-authentication even if the user has an active LuxID session.
consent	Force the consent screen to be shown again.
select_account	Not applicable. LuxID is a single-account IdP - a browser holds at most one LuxID session, so there is no account chooser.

Worked example

GET https://login.luxid.lu/mga/sps/oauth/oauth20/authorize
  ?response_type=code
  &client_id=my-app-client-id
  &redirect_uri=https%3A%2F%2Fapp.example.lu%2Fcallback
  &scope=openid%20profile%20email
  &state=af0ifjsldkj
  &nonce=f1e2d3c4b5a60789
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256
  &acr_values=urn:luxid:acr:level:substantial
  &login_hint=user%40example.lu
  &lang=fr

Not accepted / not applicable

• Implicit flow parameters (response_type=id_token or token) - not supported; use Authorization Code + PKCE.
• ui_locales - not used; LuxID uses lang (above).
• prompt=select_account - not applicable (single-account IdP).
• request / request_uri (JAR), PAR - see Advanced security options for the current status of request-object mechanisms.
• end_session_endpoint / RP-initiated logout - not offered by design. For ending a session, see the logout section of OpenID Connect.

Related pages

• OpenID Connect - the full flow these parameters drive
• Authentication levels - the acr_values mechanism and per-Partner values
• Add Login - a working end-to-end integration
• Integration security checklist - state, nonce, and PKCE verification
• Tokens and claims - what comes back, and how to validate it