OpenID Connect configuration

AnybanQID is a standard OpenID Connect provider. Point any certified client library at the issuer below and it will discover everything on this page automatically — you rarely need to copy an endpoint by hand.

Issuer

https://id.anybanq.lk/oidc

Your library discovers everything below from /oidc/.well-known/openid-configuration — also served at /.well-known/openid-configuration, which shows this page in a browser and the raw JSON to every other client.

Discover it in code

// Node — openid-client
const issuer = await Issuer.discover('https://id.anybanq.lk/oidc');
const client = new issuer.Client({ client_id, client_secret, redirect_uris });

// Available today: CIBA (poll mode) — POST /oauth2/bc-authorize with
// login_hint=nic:<12-digit NIC>, then poll /oauth2/token. See /developer.

// Coming soon: browser redirect (Authorization Code + PKCE).
// No authorization code is issued yet.
const url = client.authorizationUrl({
  scope: 'openid profile',
  acr_values: 'loa2',
  code_challenge_method: 'S256',
});

Endpoints

Authorizationauthorization_endpoint	`https://id.anybanq.lk/oidc/oauth2/authorize`Coming soon. Authorization Code + PKCE browser login — no authorization code is issued yet. Use CIBA today.
Tokentoken_endpoint	`https://id.anybanq.lk/oidc/oauth2/token`Poll a CIBA request for tokens, or refresh them. (Code exchange: coming soon.)
UserInfouserinfo_endpoint	`https://id.anybanq.lk/oidc/oauth2/userinfo`Fetch claims for the access token's subject.
JWKSjwks_uri	`https://id.anybanq.lk/oidc/.well-known/jwks.json`Public keys for verifying ID token signatures.
Introspectionintrospection_endpoint	`https://id.anybanq.lk/oidc/oauth2/introspect`Check whether a token is still active.
Revocationrevocation_endpoint	`https://id.anybanq.lk/oidc/oauth2/revoke`Revoke a refresh or access token.
End sessionend_session_endpoint	`https://id.anybanq.lk/oidc/oauth2/logout`RP-initiated logout.
CIBAbackchannel_authentication_endpoint	`https://id.anybanq.lk/oidc/oauth2/bc-authorize`Decoupled auth for call centre, POS and kiosk — no browser on the user's side.

What this provider supports

Grant types

authorization_code refresh_token client_credentials urn:openid:params:grant-type:ciba

grant_types_supported

Scopes

openid profile email phone address nic tin roles offline_access

scopes_supported

Claims

sub name gender birthdate email email_verified phone_number address nic nic_verified tin acr amr sid roles

claims_supported

Assurance levels

loa1 loa2 loa3

acr_values_supported

ID token signing

ES256

id_token_signing_alg_values_supported

Client authentication

client_secret_basic client_secret_post none

token_endpoint_auth_methods_supported

PKCE

S256

code_challenge_methods_supported

Response types

code

response_types_supported

Response modes

query

response_modes_supported

Subject types

public

subject_types_supported

CIBA delivery

poll

backchannel_token_delivery_modes_supported

CIBA request signing

ES256

backchannel_authentication_request_signing_alg_values_supported

Scopes and the claims they release

openid	`sub`Required on every request.
profile	`name`, `gender`, `birthdate`
email	`email`, `email_verifiedemail_verified` is always `false`: AnybanQID does not verify email ownership.
phone	`phone_number`
address	`address`
nicrestricted	`nic`, `nic_verified`Granted to a client by AnybanQID.
tinrestricted	`tin`The citizen's self-declared personal tax number. Granted to a client by AnybanQID.
roles	`roles`
offline_access	Refresh tokenRefresh tokens rotate on every use.

Assurance levels (acr): loa1, loa2, loa3.

Get credentials

Client IDs and secrets are issued per application. The developer portal is not self-serve yet — email hello@anybanq.lk for sandbox credentials. The integration guide is in the documentation.

Email us for sandbox credentials →