Documentation/Getting started/Onboarding

Onboarding

How your entity is registered: request, A3BC review and delivery of access.

Dynamic OIDC registration (/connect/register) is disabled: A3BC reviews each Relying Party before giving it access to its users’ data. Onboarding is manual and must be repeated for each environment (sandbox, then production).

What you provide

Information	Detail
Scopes	The information or journey options you need. See the scopes reference. Sensitive scopes require a justification.
Redirect URLs	Whitelist of allowed `redirect_uri`. Several URLs are possible.
Testers	Email address and platform (iOS, Android or both) of each person who will test the TrustMe sandbox app.

All of this is entered in the access request. The rest of the configuration is done by A3BC, in consultation with you if needed:

sub type: random (no correlation possible between interactions) or anonymized (same sub for a given user and RP, different across RPs). RPs can be grouped to share the same anonymized sub.
User journey: entering an identifier (phone, email) or scanning a QR code. Both are available for TrustMe; the private:method.* scopes can override the default.
Grants and delayed sharing options, and webhook configuration.

What you receive

Credentials: a client_id and a client_secret. The secret is delivered securely, once.
Endpoints: authorization, token, userinfo, jwks and the discovery URL that groups them.
Document API: its URL is also provided in the private:doc.* claims.
Invitations for the testers.

Each environment has its own credentials. Never reuse a sandbox secret in production.