LuxID onboarding

What is LuxID

LuxID is a Luxembourgish digital identity provider (IdP) operated by POST Luxembourg. It lets users sign in to participating applications - called LuxID Partners - with a single, secure account. From a user's perspective it works like a consumer-style "Sign in with..." button against a shared, recognisable identity service, but it is governed under Luxembourg law, operates as a sovereign service rather than as a commercial cloud platform, and is privacy-first by design - LuxID does not sell user data and does not run on an advertising business model. Any future consent-driven product (for example, opt-in retargeting) would require the user's full, explicit, revocable consent.

LuxID is not "the national digital identity" (the state-issued eID), and it is not LuxTrust. It is a Luxembourgish digital identity, operated by POST Luxembourg under delegation from a LuxID E.I.G. (Economic Interest Grouping) whose members are POST Luxembourg, RTL Group, Cactus, and CFL. LuxID is complementary to LuxTrust: LuxTrust remains an independent qualified trust service provider, and LuxID integrates with it across several flows - as a high-assurance MFA method, as a proofing backend for LuxID Verified (identity verification), and for selected account-recovery scenarios. See Relationship with LuxTrust below for the detail. This structure means LuxID operates in the interest of the broader Luxembourg economy rather than as a product of any single company.

Governance and structure

LuxID is governed through a LuxID E.I.G. structure:

Role	Entity
LuxID E.I.G. members (principals)	POST Luxembourg, RTL Group, Cactus, CFL
Operating entity (under delegation)	POST Luxembourg
Service brand	LuxID

POST Luxembourg operates the platform, manages the infrastructure, and handles day-to-day Partner onboarding. The LuxID E.I.G. retains governance rights. This structure gives LuxID a cross-sector mandate - it is not a proprietary product of any single LuxID E.I.G. member.

A shared sovereign identity service

LuxID is architecturally a shared sovereign identity service: one identity authority used by many Partner services across the Luxembourg ecosystem. The key implications for developers:

• There is one LuxID. Partners integrate with LuxID; they do not instantiate their own copy of it.
• You do not need to manage tenants, authentication policies, MFA orchestration, breached-password detection, signing-key rotation, fraud signals, or login UX. LuxID does the heavy lifting and exposes a standards-based integration surface (OIDC, OAuth 2.0, SAML 2.0).
• You register Applications, declare the claims you need (subject to LuxID review for data minimisation), and choose your assurance requirements. LuxID handles the rest.

This is fundamentally different from CIAM platforms on which each customer configures and operates their own identity stack. If you are coming from a self-configured CIAM background, set aside the tenant-management and policy-configuration habits - that complexity is intentionally hidden here.

Privacy-first positioning

LuxID is designed to minimise data exposure:

• Users explicitly consent to each claim (attribute) shared with each Partner.
• Consent is granular and revocable at any time from https://account.luxid.lu/ (opens in a new tab).
• Pseudonymisation is built into the platform via the Sphere model - different Partners may see different sub values for the same user, preventing cross-Partner tracking without user consent.
• LuxID does not sell user data and does not run on an advertising business model today. Any future consent-driven product (for example, opt-in retargeting) would require the user's full, explicit, revocable consent.

Relationship with LuxTrust

LuxTrust and LuxID are complementary services, not competing ones. Neither is subordinate to the other: LuxTrust is not subordinate to LuxID, and LuxID is not subordinate to LuxTrust.

• LuxTrust is a qualified trust service provider (QTSP) under eIDAS Regulation (EU) No 910/2014 (opens in a new tab). It issues qualified certificates and provides high-assurance digital signatures and authentication (LuxTrust mobile app, smartcard).
• LuxID uses LuxTrust in three distinct roles, and a user may use any, all, or none of them:
  • As an MFA method. A LuxTrust certificate holder can enrol it as a second factor inside LuxID, enabling High assurance when a Partner requires it.
  • As the identity-proofing backend for LuxID Verified. When a user opts in to LuxID Verified, LuxTrust performs the identity verification; the verified status is then held on the LuxID Account and surfaced to Partners as a claim.
  • As a recovery means. A user who has enrolled LuxTrust can use it to regain control of their LuxID Account if they lose access to the email mailbox linked to the account (or other primary authentication factors).
• A user can have a LuxID Account without ever using LuxTrust. The three roles above are optional, additive, and require explicit user action.

The luxtrust tag in these docs refers specifically to LuxTrust used as an MFA method within LuxID. The identity-verification tag refers to the separate LuxID Verified identity proofing process.

How LuxID relates to LuxTrust and the EUDI Wallet

LuxID, LuxTrust, and the EUDI Wallet are the three identity-infrastructure pieces a Luxembourg integrator is most likely to evaluate together. They serve overlapping but distinct purposes.

Dimension	LuxID	LuxTrust	EUDI Wallet
Governance	Luxembourg LuxID E.I.G. / POST	Luxembourg QTSP (accredited)	EU Member States
Architecture	Single-tenant sovereign IdP	PKI / qualified certificates	Decentralised wallet
Primary purpose	Authentication + authorisation for Partner apps	Qualified signatures + high-assurance authentication	Portable EU identity credentials
MFA methods	OTP (SMS/voice), TOTP, passkeys, LuxTrust	LuxTrust mobile / smartcard	Wallet-internal biometrics
Assurance levels	auth_level scale 2-9 (LuxID's own classification). Aligns with eIDAS principles but does not issue formal LoA.	Substantial, High (High is qualified under eIDAS)	Substantial / High (eIDAS)
Claim scope	Profile, email, phone, custom	Certificate attributes	National ID, driving licence, etc.
Partner integration	OIDC, OAuth 2.0, SAML 2.0	OIDC, SAML 2.0, CAdES, XAdES, PAdES	ISO 18013-5, SD-JWT VC
Data sovereignty	Luxembourg / POST infrastructure	Luxembourg / LuxTrust infrastructure	Member State infrastructure

Supported use cases

LuxID Partners are typically Luxembourg-based businesses and organisations. End users are predominantly from Luxembourg and the Greater Region, but LuxID does not restrict who can hold an account. Some features - LuxTrust 2FA and LuxID Verified identity proofing in particular - assume a Luxembourg footprint and apply mainly to local users.

Consumer Applications in Luxembourg

Any consumer-facing website or mobile app operating in Luxembourg can add "Sign in with LuxID" to let users authenticate with their existing LuxID Account. Users avoid creating yet another username and password; Partners avoid managing credentials and password-reset flows.

Examples: RTL, RTL Play, MyPost, DEEP ControlCenter, CFL P+R, CFL GO.

Enterprise and B2B Applications (LuxID Pro federation)

LuxID Pro is LuxID's enterprise federation service. An Organization federates its corporate IdP (Microsoft Entra ID, Google Workspace, Okta, ADFS, Ping, ...) with LuxID, so its employees sign in to LuxID-integrated applications with their corporate accounts rather than a personal LuxID Account. The Organization keeps lifecycle, MFA and policy control in its own IdP; LuxID Pro Partners can also restrict which applications their federated users may reach.

For the developer, the practical promise is: integrate with LuxID once, and federation handles the per-customer routing for every enterprise customer. Particularly valuable for B2B applications serving multiple Organizations. See Single Sign-On for the feature reference and the per-corporate-IdP setup cookbook.

Identity verification via LuxID Verified

LuxID Verified is an identity-attribute verification layer built on top of LuxID. A user can verify selected personal attributes through a qualified service (currently LuxTrust, and the EUDI Wallet in the future). The verified attributes are then carried on the user's LuxID Account and released to Partners as claims, subject to user consent.

The current scope is deliberately narrow: LuxID Verified verifies the user's name and date of birth only. Other attributes may be added later.

Partners that consume LuxID Verified receive, alongside the verified attribute itself: a flag indicating it has been verified, the assurance level reached, and the timestamp of the verification. They do not receive the proofing source - that information is held internally by LuxID. The maximum assurance level reachable via LuxID Verified is Substantial; LuxID Verified does not on its own grant High assurance.

The primary use case is data quality. Partners that need to operate on accurate, up-to-date personal data benefit from verified claims rather than self-declared ones. This is in the user's interest and helps Partners meet the GDPR data-accuracy principle (Regulation (EU) 2016/679, Art. 5(1)(d) (opens in a new tab)). Higher-assurance identity proofing for regulated purposes (for example, financial KYC, qualified electronic signatures, regulated onboarding) falls under the eIDAS and eIDAS 2 regulatory framework. Partners with those requirements typically achieve them using a notified national eID, a qualified trust service provider such as LuxTrust, or - once available - the EUDI Wallet, rather than via LuxID Verified.

OpenRoaming Wi-Fi

LuxID supports the OpenRoaming (opens in a new tab) specification, allowing LuxID-authenticated users to automatically connect to OpenRoaming-compatible Wi-Fi networks at participating venues in Luxembourg without additional credentials.

What Partners are

A LuxID Partner is any organisation that has signed a LuxID Agreement and integrated at least one Application with LuxID. Partners are services - paid or free, in any sector - operated by organisations that have onboarded: POST Luxembourg's own products, RTL's media platforms, Cactus's retail services, CFL's transport services, Luxchat's free messenger, and others.

The domain model has five levels:

• Organisation - the legal entity that signs the LuxID Agreement (e.g. RTL Group S.A.); has zero or more Partners.
• Partner - the API access unit holding client credentials (e.g. the RTL Partner, with its client_id and client_secret); belongs to one Organisation; associated with one or more Spheres; may have management rights on zero or more Groups.
• Application - a concrete software product (e.g. the RTL.lu website), registered independently in each environment (UAT and Production); belongs to exactly one Sphere; managed by zero or one Partner.
• Sphere - the pseudonymisation domain that determines the user's sub; can be shared between Partners when consistent user identifiers are needed across Partner boundaries (e.g. POST Luxembourg and POST Telecom sharing a Sphere so a user has the same sub across both services).
• Group - a cross-Sphere authorisation mechanism; a Group can protect Applications in any Sphere; an Application may be protected by multiple Groups (access is granted if the user is in any one of them - logical OR); Partners hold management rights on the Groups they administer.

A single Organisation may have multiple Partners, and a single Partner may manage multiple Applications and Groups. See Roles in the ecosystem for the full model.

The user account

Every LuxID user has a single account identified by their email address. Email is the LuxID identifier - the term "username" refers to a legacy sign-in method that is not promoted for new integrations.

A single physical person may hold multiple LuxID Accounts, provided each one is tied to a distinct, validated email address (for example, a personal mailbox and a professional mailbox). LuxID treats each email-distinct account independently: they have their own consents, their own Subscriptions, and their own pseudonymous sub values per Sphere. LuxID does not attempt to link them.

LuxID always verifies the email address at account creation by sending a one-time activation code. Until the user validates the code, the account stays in a pending state and cannot be used to sign in to any Application. Pending accounts that are never activated are eventually purged.

Users manage their account - including connected applications, consent, 2FA methods, and personal data - at https://account.luxid.lu/ (opens in a new tab). For users signing in via LuxID Pro, the underlying account is managed by the Organization that owns the federated domain (lifecycle, credentials, MFA policy, and revocation are handled in the corporate IdP, not at account.luxid.lu).

Becoming a Partner: the process at a glance

Becoming a LuxID Partner is a structured, reviewed process - there is no self-serve sign-up. In short:

1. First contact - email hello@luxid.lu with your organisation, the service you want to integrate, and your intended use case.
2. Agreement and review - organisation verification (KYB) and signature of the LuxID Agreement.
3. Technical onboarding - you receive UAT credentials and integrate against the sandbox (Configure LuxID walks through it).
4. Go-live review and production credentials.

The typical end-to-end timeline is 4 to 8 weeks, depending on the complexity of your integration. The full process, required documents and review criteria are described in Service provider onboarding. Once you have signed the Agreement, operational requests go to servicedesk@post.lu - see Contact and support channels for the routing rules.

Next steps

• Read Learn the basics for the conceptual model and supported standards.
• Read Configure LuxID to start the Partner onboarding process.
• If you are evaluating whether LuxID is the right choice, read Plan and design for the architectural decision matrix.