Glossary

A single-page, alphabetical reference to the terms that recur across the LuxID developer documentation. Each entry gives a one-line definition and links to the page where the concept is treated in full. Where a term is defined more deeply elsewhere, that page is canonical.

For the narrative introductions rather than definitions, start with Concepts and fundamentals or Learn the basics.

A

Access Token - A short-lived bearer credential presented to a resource server (for example, the LuxID UserInfo endpoint or your own APIs) to prove authorisation. Not intended for identity assertion. See Tokens and claims.

acr / acr_values - The acr claim in the ID Token conveys the Authentication Context Class the user reached (LuxID expresses this as a URN, e.g. urn:luxid:acr:level:substantial). An Application requests a minimum by passing acr_values on the authorisation request; LuxID steps up authentication if the current session does not satisfy it. See Authentication levels.

amr - The Authentication Methods References claim, listing the methods used in the authentication (for example pwd, otp, fido). See Tokens and claims.

Application - A concrete software product (website, mobile app, kiosk, backend service) belonging to exactly one Partner, with its own registered redirect URIs, declared claims, and Sphere. See Roles in the ecosystem.

Assurance levels (Low / Substantial / High) - The rationale LuxID's auth_level scale structurally mirrors, aligned with the eIDAS Low / Substantial / High tiers. LuxID is not a notified eID scheme and does not issue formal eIDAS LoA assertions; eIDAS LoA values appear only when relayed from a qualified upstream. See Authentication levels.

auth_level - LuxID's own numeric authentication-strength scale (2/3/4/8/9), assigned automatically from the methods the user completed and conveyed via the acr claim. See Authentication levels.

C

Claim - A single piece of user data (for example email, given_name) asserted by LuxID in a token. See Tokens and claims.

Claim Template - A declared attribute a Partner's Application is permitted to request. What an Application receives is governed by its Claim Template, not by the OAuth scope parameter. Claim Templates are typed (USER or TECHNICAL) and marked essential or voluntary. See Roles in the ecosystem and Learn the basics.

Consent - A User's explicit agreement to release specific claims to a specific Application, captured on the LuxID consent screen and creating a Subscription. See Privacy and consent.

G

Group - An authorisation grouping inside a Partner (for example admin, editor, vip) whose memberships surface as a token claim and can be referenced in Access Rules. See Roles in the ecosystem.

I

ID Token - A signed JWT asserting the User's identity, consumed by the Application (never passed to APIs). Lasts about an hour. See Tokens and claims.

IdP (Identity Provider) - The system that authenticates the user and issues tokens. In a LuxID integration, LuxID is the IdP and your application is the Relying Party. See Learn the basics.

J

JAR (JWT-Secured Authorization Request) - A mechanism for passing the authorisation request as a signed JWT. Not currently advertised by the LuxID production discovery document. See Advanced security options.

JWKS (JSON Web Key Set) - The set of public keys LuxID publishes so Partners can verify token signatures; keys rotate periodically and should always be fetched dynamically. See Key management.

L

LuxID - A Luxembourgish digital identity provider operated by POST Luxembourg: a shared sovereign identity service used by many Relying Parties who integrate with it but do not operate their own tenant. See Concepts and fundamentals.

LuxID Partner - See Partner.

LuxID Pro - The enterprise federation service that lets an organisation's employees authenticate via their corporate IdP rather than a separate LuxID Account. See Single sign-on and LuxID Pro.

LuxID Verified - Identity attribute verification via LuxTrust, confirming name and date of birth. Reaches Substantial (the LoA is issued by LuxTrust and relayed by LuxID). See LuxID Verified.

LuxTrust - A qualified authentication method (mobile app or smartcard) available as a second factor on LuxID, and the identity-proofing source behind LuxID Verified. See Multi-factor authentication and Authentication levels.

M

MFA (Multi-factor authentication) - Requiring more than one factor at sign-in. LuxID supports four second-factor categories: One-Time Codes (OTP), authenticator apps (TOTP), passkeys, and LuxTrust, enforced by requested assurance level rather than by method. See Multi-factor authentication.

O

OAuth 2.0 - The underlying authorisation framework (RFC 6749 (opens in a new tab)) that OIDC builds on. Used directly only when an application needs access tokens but not identity assertion. See OAuth 2.0 for APIs.

OIDC (OpenID Connect) - A thin identity layer on top of OAuth 2.0 (OpenID Connect Core 1.0 (opens in a new tab)) and the recommended standard for new LuxID integrations. See OpenID Connect.

Organization - The top-level legal entity (company or public body) that signs the LuxID Agreement; one Organisation may hold multiple Partners. See Roles in the ecosystem.

OTP (One-Time Code) - A random code delivered out-of-band, by SMS by default with voice call as a fallback. Distinct from TOTP. See Multi-factor authentication.

P

PAR (Pushed Authorization Requests) - A mechanism for submitting the authorisation request directly to the IdP before redirecting the user. Not currently advertised by the LuxID production discovery document. See Advanced security options.

Passkey / WebAuthn - A FIDO2 / WebAuthn device-bound credential enabling phishing-resistant passwordless sign-in (W3C WebAuthn Level 2 (opens in a new tab)). See Passwordless and passkeys.

Partner (LuxID Partner) - The unit of API access; holds the Client ID and Client Secret and owns registered Applications, Claim Templates, and Groups. One Organisation may have multiple Partners. See Roles in the ecosystem.

PKCE (Proof Key for Code Exchange) - The recommended protection for the Authorization Code flow (RFC 7636 (opens in a new tab)), used with code_challenge_method=S256. See OpenID Connect.

R

Refresh Token - A long-lived credential used to obtain new Access Tokens silently. In LuxID it rotates on every use: each refresh returns a new token and revokes the previous one. See Tokens and claims and Session management.

Relying Party (RP) - An application that relies on LuxID to authenticate users; a LuxID Partner Application acts as the RP. See Learn the basics.

S

SAML 2.0 - An XML-based federation standard (SAML 2.0 Core (opens in a new tab)) supported for enterprise SaaS platforms that cannot use OIDC. See SAML 2.0.

Sphere - A pseudonymisation domain: Applications in the same Sphere share the same sub for a given User, while Applications in different Spheres receive different sub values, preventing cross-context tracking. See Roles in the ecosystem.

Subscription - A User's connection to an Application, created on first consent and terminated on revocation. It is also LuxID's billing unit. See Roles in the ecosystem.

T

TOTP - A time-based code derived locally from a shared secret by an authenticator app such as Aegis, FreeOTP, or Microsoft Authenticator (RFC 6238 (opens in a new tab)). Distinct from OTP. See Multi-factor authentication.

U

Universal Login - LuxID's hosted, redirect-based login page, where authentication and the consent screen are presented. See Universal Login.