Upcoming Changes

New signing solution

The BankID Server signing and signing using Signdoc over OpenID Connect (OIDC) is being migrated to a new BankID Signing solution.

Check out the migration guide.

New Data Sharing service

The experimental Consent service that provides unverified user data (email, address, phone) through the Userinfo endpoint, is planned to be discontinued.

The service is being replaced by a new, upcoming Data Sharing service.

This impacts you if you use any of the following scopes:

• email
• address
• phone
• nnin

This new Data Sharing service aims to provide verified, consented, user data with a modern user experience.

The goal is to be backwards compatible and still use the Userinfo endpoint to share the data.

Note that profile information such as full name and birthdate are available in the ID Token via profile scope. If you have legal authority, NNIN will still be available via the nnin_altsub scope. nnin scope can be used to ask user for consent.

The onboarding flow using nnin and id_token_hint is also discontinued.

More information and documentation on migrating to alternative services will be available soon.

API Version changes from October/November 2025

In April 2025 we announced changes to the BankID OpenID Connect platform in the end of October/November 2025. The minimum API version was set to 4.

This included changes to basic requirements, such as:

• It's always required to use PKCE (Proof Key for Code Exchange) in Authorization Code flow.
  • Azure B2C integrations can opt-out. Contact BankID support or your BankID partner.
• The following parameters in Authorization Code flow are now required:
  • response_type
  • state
  • nonce
• NNIN (Fødselsnummer) login_hint must be securely transmitted using PAR or encrypted request objects.
• ID and Access tokens will be signed using ES256 signature algorithm.
  • Signing keys will be rotated more regularly. Get keys from the JWKS endpoint, and see how to validate tokens.
• Information on proof of transaction is available here.

Read about all API changes here.

Test your integration

You can always override the API version to use. Just add the parameter api_version with the desired version to the Authorize Request. The minimum value is 4.