◈AnybanQID

Build with AnybanQID

AnybanQID is Sri Lanka's BankID-style digital identity. Your users prove who they are once, then approve logins, transactions and document signatures on their phone — biometric-gated, device-bound, standard OpenID Connect on your side.

Use cases

🔐 Login with AnybanQID

  • Web & mobile sign-in — replace passwords with a phone approval.
  • Standard OIDC Authorization Code + PKCE; any certified client library works.
  • Assurance levels loa1–loa3 via acr_values.

📲 Decoupled auth (CIBA)

  • Call centre, POS, kiosk — no browser on the user's side.
  • Initiate with login_hint=nic:<nic>, poll for tokens.
  • The user approves the push on their phone.

💸 Transaction approval

  • Confirm payments with signed display data (amount, merchant).
  • Create a push order server-side; poll its status.
  • What the user sees is what gets signed.

✍️ e-Signatures

  • Sign documents with the citizen's device key (PAdES).
  • Multi-signer ordering, hash-reviewed on the phone.

How a login flows

Authorization Code + PKCE — the standard integration
Your app AnybanQID User's phone GET /oauth2/authorize (code_challenge) push login order approve — biometric + device signature 302 ?code=… POST /oauth2/token (code_verifier) access + id + refresh tokens

Set up in four steps

Register your application

Create an OAuth client in the developer portal — you'll get a client id/secret and register your redirect URIs. Enable the CIBA grant if you need decoupled auth.

Discover the endpoints

curl https://id.anybanq.lk/.well-known/openid-configuration

Wire up any OIDC client — PKCE S256 is required

import { Issuer } from 'openid-client';
const issuer = await Issuer.discover('https://id.anybanq.lk/oidc');
const client = new issuer.Client({
  client_id: process.env.ANYBANQID_CLIENT_ID,
  client_secret: process.env.ANYBANQID_CLIENT_SECRET,
  redirect_uris: ['https://app.example.lk/auth/callback'],
  response_types: ['code'],
});

Handle tokens & refresh

Tokens are ES256-signed; refresh tokens rotate on every use with reuse detection — always store the newest one. Full flow diagrams (push orders, CIBA, error codes) live in the documentation.

Read the full documentation →