Authenticate
Developers implementing login, API protection or SAML. If you are an IT administrator configuring an off-the-shelf tool, use Quick integrations instead - it covers the same protocols without the code.
Overview
This section is the technical heart of LuxID developer documentation. It covers how to implement login, protect APIs, and federate identities using the three supported protocols:
- OpenID Connect (OIDC) - the primary protocol for web and mobile applications
- OAuth 2.0 - the authorisation layer underpinning OIDC, documented separately for API protection patterns
- SAML 2.0 - for enterprise integrations and no-code SaaS connectors that require it
LuxID is a shared sovereign identity service - there is no tenant provisioning step. Your application integrates with the LuxID platform directly, using credentials issued by POST Luxembourg under the LuxID Agreement signed at your Organization level. You do not need to manage tenants, authentication policies, or signing keys on your side - LuxID does the heavy lifting.
Choose your protocol
Use the flowchart below to select the right protocol for your integration.
When in doubt, choose OIDC - it is the most capable, the most widely supported, and the one LuxID is optimised for.
Section contents
| Page | What you will learn |
|---|---|
| Add Login | Build Authorization Code + PKCE from scratch in 15 minutes, with cURL examples and a full sequence diagram |
| OpenID Connect | Full OIDC protocol reference: discovery, all request parameters, token validation, UserInfo, refresh, silent re-auth, logout |
| OAuth 2.0 for APIs | Bearer token patterns, scope design, introspection, revocation, and API protection |
| SAML 2.0 | SAML SP-initiated SSO, metadata exchange, assertion structure, attribute mapping, and logout handling |
| Platform and framework guides | Drop-in config snippets for 11 libraries and frameworks (Spring, ASP.NET Core, Node.js, Next.js, React, Angular, React Native, iOS, Android, PHP, Python) |
| Code samples and reference repos | Curated starter repositories and token validation recipes |
Key facts before you start
- LuxID does not ship its own SDK. Use the community-maintained OIDC/OAuth 2.0 libraries listed in Platform and framework guides.
- All endpoints are documented in the Discovery document (opens in a new tab).
- PKCE (
code_challenge_method=S256) is mandatory for public clients (SPAs, native apps) and strongly recommended for confidential clients. - ID tokens are signed RS256. Validate the signature against the JWKS endpoint (opens in a new tab) on every token exchange.
- Your application's redirect URIs, scopes, and claim templates must be configured with LuxID before you begin. See Configure LuxID.
Related sections
- Concepts and fundamentals - token anatomy and claims reference
- Secure - CSRF protection, HTTPS requirements, cookie security
- Session management - local session lifecycle after authentication
- APIs and advanced - UserInfo, introspection, revocation