OIDC implementation

1. What is the "state" parameter and how should I use it?
   The state parameter serves two purposes:

   1. Prevention of Cross-Site Request Forgery attacks, and
   2. Managing user landing location after OIDC completion.
   Use a signed/encrypted JWT or encrypted string containing a hash of your portal's session cookie (rfp) and the target landing URI (target_link_uri).
   Reference : Using state parameter to control user’s landing location on portal
2. What are the required HTTP headers for Aikyam API calls?
   Three headers are strongly recommended:

   • aikyam-ext-corr-id: Correlation ID for log tracking.
   • aikyam-caller: Format: <platform>.<product-navigation>.<originated-service>
   • user-agent: For backend calls, use <aikyam-caller>.<aikyam-ext-corr-id>
   Reference : Preparation for the future investigations
3. Do I need to perform eligibility/authorization checks myself?
   Yes. HSID EDA does not provide eligibility/authorization checks in OIDC.You must build your own eligibility/authorization check service that uses the HSID UUID as input and retrieves identity information from the HCP Userservice read operation.
   Reference : Eligibility/authorization decoupling requirement

Mobile integration

1. How do I implement PKCE for mobile apps?
   Mobile apps must use PKCE (Proof Key for Code Exchange) with the S256 challenge method. Generate a code_verifier, create a code_challenge using SHA-256, include it in the authorization request, and send the code_verifier in the token request.
   Reference : Mobile PKCE – OIDC (mobile app only)
2. Where can I test code_challenge generation online?
   Use online tools like https://tonyxu-io.github.io/pkce-generator/ or https://example-app.com/pkce to generate and verify code_challenge and code_verifier pairs for testing.
   Reference : How to generate “code_challenge” and “code_verifier” online for testing

Advanced features

1. What is fast track registration (FTR)?
   FTR is an invitation-based registration that streamlines user registration. Portal teams integrate with the Invitation API to generate registration links that prepopulate user information, which are then sent through email, SMS, or marketing campaigns.
   Reference : Fast track registration
2. What is portal initiated step-up?
   This feature converts an unmatched account to a matched account. It is useful for hybrid portals where users initially register as unmatched but later need to be associated with an EiMP Golden Record. The portal collects identity attributes and passes them to HSID through an encrypted login_hint parameter.
   Reference : Portal initiated step-up (For hybrid portals)
3. What is assisted registration?
   Assisted Registration helps prospect users create accounts by pre-filling identity attributes rather than having users type everything on the HSID registration page. The portal passes known attributes through an encrypted login_hint parameter in the OIDC authorization request with prompt=create.
   Reference : Assisted registration (For hybrid / matched portals)
4. How do I generate a login_hint for portal initiated step-up or sssisted registration?
   Create a JSON payload with identity attributes (Big 4: firstName, lastName, dateOfBirth, search_keys, and optionally email or phone), Base64url-encode it, encrypt it using AES-256-CBC with the shared key and IV, and then Base64url-encode the result. A generator/decryptor tool is available for testing.
   Reference : Portal initiated step-up login_hint specification , Assisted registration login_hint specification