> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/identity-verification/ial2-verification/oauth-2.0-and-oidc.md).

# OAuth 2.0 and OIDC

***

## Triggering IAL2 Verification Using OAuth 2.0 and OIDC

Users can upgrade their own status to IAL2 in AdminX by using the 1Kosmos web-based identity-proofing flow. Tenant and community administrators can trigger this flow using OpenID Connect (OIDC) ACR claims.

### Prerequisites

* A configured OIDC application in AdminX.

Before starting, ensure you have configured an OIDC application for SSO. See[ OIDC Integration in AdminX](broken://spaces/HOTUyFysR7VGBxLPNQgq/pages/OrNxj40Mvau8KV8HLlB1) for more information.

To view your OIDC application settings:

1. Navigate to your AdminX portal and log in as a tenant or community administrator.
2. Go to the **Applications** page and find your OIDC application.
3. Click the pencil icon under **Actions** to view the OIDC application settings.

Your **Client ID** and **Client Secret** can be viewed and copied from this screen.

### Fetch Current IAL Using Custom Scope

Your current IAL can be requested using the **`/assurance/ial/2`** custom scope, as shown below:

```
https://blockid-trial.1kosmos.net/oauth2/community/default/v1/authorize
  ?response_type=code
  &client_id=ae0456c92ac24f0ace200f103ab93c81
  &scope=email openid /assurance/ial/2
  &redirect_uri=https://google.com
  &state=123
```

The OIDC response returned by the server contains the user's current IAL, located in the `amr` parameter.

### Requesting IAL2 Step-Up Verification

#### Using Custom Scope

IAL2 step-up verification can be requested using the **`/assurance/ial/2`** custom scope in your request, as shown below:

```
https://blockid-trial.1kosmos.net/oauth2/community/default/v1/authorize
  ?response_type=code
  &client_id=ae0456c92ac24f0ace200f103ab000000
  &scope=openid /assurance/ial/2
  &redirect_uri=https://google.com
  &state=123
```

Response payload:

```json
{
  "sub": "1PJ8RjLctvisMZvADuKNp",
  "ial": "IAL2",
  "acr": "/assurance/ial/2/",
  "amr": [
    "IAL2"
  ],
  "at_hash": "zYYYvMoJBs9v4kOhiyt000",
  "aud": "33724c7d05e452695658af5a38500000",
  "exp": 1680079821,
  "iat": 1680076221,
  "iss": "https://blockid-trial.1kosmos.net/oauth2/community/default"
}
```

From a user's standpoint, they are redirected to AdminX to perform their step-up identity verification instead of a standard login. Once the identity verification is completed, the user is at IAL2.

#### Using ACR Claims

IAL2 step-up verification can also be requested using **ACR Claims**, as shown below:

```
<authorize_endpoint>
  ?response=...
  &client_id=...
  &scope=...
  &redirect_uri=...
  &state=...
  &claims={ "id_token": { "acr": { "values": ["/assurance/ial/2/"] } } }
```

From a user's standpoint, they are redirected to AdminX to perform their identity verification instead of a standard login. Once the identity verification is completed, the user is at IAL2.

### OIDC Responses

Depending on the user's current IAL level after performing their identity verification, the server returns different responses. The table below shows the OIDC responses returned after a user has attempted an identity verification.

| Requested AuthnContext | User's IAL Level After Identity Verification                    | OIDC Response                                            |
| ---------------------- | --------------------------------------------------------------- | -------------------------------------------------------- |
| IAL2                   | IAL1 (Failed Identity Verification or Insufficient Information) | `{ "acr": "/assurance/ial/2/", "amr": [] }`              |
| IAL2                   | IAL2                                                            | `{ "acr": "/assurance/ial/2/", "amr": ["IAL2"] }`        |
| IAL2                   | IAL3                                                            | `{ "acr": "/assurance/ial/2/", "amr": ["IAL2","IAL3"] }` |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/identity-verification/ial2-verification/oauth-2.0-and-oidc.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.