https://api.id.gov.sg/v2/oauth/authorize?
response_type=code
&client_id=abc
&redirect_uri=https://example.com/callback
&scope=openid%20myinfo.name%20myinfo.passport_expiry_date%20myinfo.nric_number
&code_challenge=zaqUHoBV3rnhBF2g0Gkz1qkpEZXHqi2OrPK1DqRi-Lk
&nonce=BQO8SV3ALIYA808IZ8O7PKWRI8A8X6MI
&state=tk39drykro3
JWT token with the associated user claims. Encodes the following:
End user's unique identifier for your client - This is the same value as the sub claim in the id\_token returned from the previous response.
Note that as part of sgID's privacy-preserving measures, each end user's unique identifier is different for each sgID client
| | key | An AES-128-GCM symmetric key, or a **block key**, that is encrypted with your client's RSA-2048 public key. | | data |JSON object which contains the data you requested in your application scope. To prevent sgID from reading the data, the payload is encrypted with the block key referenced in the definition for the key attribute in the same response body.
Refer to the following section for instructions on decrypting the payload.
| Example JSON response body: ```javascript { "sub": "abcdef", "key": "eyJhbGcDpgYRL4chyXTjgim...[truncated]...Gxa2tO7nghnu-ewD5ZqA", "data": { // Note: this will contain all the scopes you requested "myinfo.nric_number": "eyJlbmMiOiJ...[truncated]...QafqHmGERc3A", "myinfo.name": "eyJlbmMiOi...[truncated]...UgJ9hDSTNLVw", "myinfo.passport_expiry_date": "eyJlbmMiOi...[truncated]...UvS41pKk9VKQ", } } ``` ### Step 5: Decrypt the user info payload As part of sgID's privacy-preserving measures, user data is transmitted in encrypted form, so that the sgID server is unable to read the data being transacted. The data is encrypted with a **block key**, which itself is encrypted with your client's public key so that only your client has access to the block key. Therefore, to obtain the user data in plaintext, you will need to: 1. Decrypt the `key` received from the user info response with **your client's private key**. This will give you the **block key.** 2. Decrypt the `data` received from the user info response with the **block key** you have just obtained.  Example decryption: {% tabs %} {% tab title="Javascript" %} ```javascript // We use the node-jose package for working with JWEs and JWKs // https://github.com/cisco/node-jose import { JWE, JWK } from 'node-jose' /** * Decrypts data into an object of * plaintext key-value pairs * * @param {string} encKey - encrypted block key * @param {array} block - data * @param {string} privateKeyPem - private key in pem format * @returns {object} */ async function decryptData(encKey, block, privateKeyPem) { const result = {} // Decrypted encKey to get block key const privateKey = await JWK.asKey(privateKeyPem, 'pem') const key = await JWE.createDecrypt(privateKey).decrypt(encKey) // Parse the block key const decryptedKey = await JWK.asKey(key.plaintext, 'json') // Decrypt data for (const [key, value] of Object.entries(block)) { const { plaintext } = await JWE.createDecrypt(decryptedKey).decrypt(value) result[key] = plaintext.toString('ascii') } return result } ``` {% endtab %} {% tab title="Python" %} ```python from jwcrypto import jwk, jwe def decrypt_data(self, encrypted_key: str, encrypted_data: dict): # Load private_key private_key = jwk.JWK.from_pem(self.private_key.encode("utf-8")) jwe_key = jwe.JWE() # Decrypt encrypted_key to get block_key jwe_key.deserialize(encrypted_key, key=private_key) block_key_json = jwe_key.payload # Load block_key block_key = jwk.JWK.from_json(block_key_json.decode("utf-8").replace("'", '"')) jwe_data = jwe.JWE() # Initialise dict data_dict = {} for field in encrypted_data: # Decrypt encrypted_data[field] to get actual_data jwe_data.deserialize(encrypted_data[field], key=block_key) data_dict[field] = jwe_data.payload.decode("utf-8") return data_dict ``` {% endtab %} {% endtabs %} Example of decrypted data: ```javascript { "myinfo.name": "TIMOTHY TAN CHENG GUAN", "myinfo.nric_number": "S3000786G", "myinfo.passport_expiry_date": "2024-01-01", } ``` [^1]: