> **Description:** Complete this checklist to ensure your Login API integration meets all requirements and best practices.

# Login API checklist

Did you try out the Login API?
Use this checklist as your integration requirement specification to ensure your Login API implementation is complete and production-ready.
It covers the key endpoints, quality assurance steps and pitfalls. Once you have completed your integration you must use the checklist to ensure that you have covered all areas of the integration.

## Flow to go live for partner integrations

1. Complete your testing of the Login API. Use below list to ensure you cover all areas of the integration before you submit the checklist.

1. Send your filled out Login checklist to us at [developer@vippsmobilepay.com](mailto:developer@vippsmobilepay.com).
Use this [editable PDF](https://developer.vippsmobilepay.com/downloads/login-api/login-checklist.pdf) to fill out and submit. Request examples in the checklist **must be no more than 1 month old** at the time you submit the checklist.
Together with the checklist please include a video of your Login flow and a short description of your solution. The video must include both a successful login flow and a failed login flow (where the user rejects the login).

1. Fill out [production sign up form](https://vippsmobilepay.com/en-NO/partner-form) with details about your company and solution.

1. We will verify your integration and get back to you as soon as possible.
After the checklist is approved, we'll send you the information you need to go live.

**[Download the PDF](https://developer.vippsmobilepay.com/downloads/login-api/login-checklist.pdf)** -- an editable PDF you can fill out and track your progress.

## Flow to go live for direct integrations

1. Order
   [*Login*](https://vippsmobilepay.com/en-NO/online/login).
1. We will complete customer control (KYC, PEP, AML, and other compliance checks).
As soon as the customer control is completed, independently of this checklist, we will make the production API keys available on the
   [business portal](https://portal.vippsmobilepay.com) and notify you that you can retrieve your keys.
1. [Retrieve your API keys](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-find-the-api-keys).
1. Complete all the checklist items.
1. Verify the integration in the test environment.
1. Verify the integration in the production environment:
1. Partners only: Send your checklist to [developer@vippsmobilepay.com](mailto:developer@vippsmobilepay.com).
   We don't do any kind of activation or make any changes based on this checklist, we just use it to verify that you have done the integration.
1. Go live

| Login API checklist |
| --- |
| ## Endpoints to integrate For examples of requests and responses, see the [quick start guide](https://developer.vippsmobilepay.com/docs/APIs/login-api/login-api-quick-start.md). |
| ### OpenID connect (Get OIDC well-known endpoint) [`GET:/access-management-1.0/access/.well-known/openid-configuration`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ### JSON web keys discovery [`GET:/access-management-1.0/access/.well-known/jwks.json`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ### OAuth 2.0 authorize (*Only required if using the [Login from a website flow](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/browser-flow-integration.md)*) [`GET:/access-management-1.0/access/oauth2/auth`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ### OAuth 2.0 token [`POST:/access-management-1.0/access/oauth2/token`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ### CIBA authentication (*Only required if using the [Merchant-initiated login flow](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/merchant-initiated-login-integration.md)*) [`POST:/vipps-login-ciba/api/backchannel/authentication`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ### User exists (*Only required if using the [Merchant-initiated login flow](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/merchant-initiated-login-integration.md)*) [`POST:/vipps-login-ciba/api/v1/user-exists`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml) |
| ## Quality assurance |
| ### Ensure functionality Verify that your solution works seamlessly across all browsers, including non-default mobile browsers (e.g., initiating login from Chrome on iOS). |
| ### Connect existing accounts Implement proper linking of the Vipps or MobilePay user to your own user registry. See [recommendations on linking to user account](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/important-information.md#best-practices-for-linking-user-accounts). |
| ### Handle errors Make sure to log and handle all errors. For example, handle cancelled logins and error situations while redirecting the user back to `redirect_uri` (i.e., redirect with an `error` query parameter). In addition, display errors in a way that the users (customers and merchant employees/administrators) can see and understand them. |
| ## Avoid integration pitfalls |
| ### Use correct flow Native app integrations use the [Login from a mobile app](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/mobile-app-flows/README.md) flows. [Merchant-initiated login](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/merchant-initiated-login-integration.md) must *not* be used for web-based login. |
| ### Do not use embedded iFrames Integration with the Login API is redirect-based (i.e., do not use an embedded iFrame). |
| ### Set company name and logo The sales unit name appears on the Vipps MobilePay landing page. Both the name and logo appear in the Vipps or MobilePay app under *Personal information* > *Companies with access*. See [how to change name and logo](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-can-i-change-my-name-and-logo). |
| ### Whitelist redirect URIs Ensure that each `redirect_uri` for your integration has been added to the business portal whitelist. See the [FAQ](https://developer.vippsmobilepay.com/docs/APIs/login-api/login-api-faq.md#how-can-i-activate-and-set-up-login) for how to do this. Ensure that all URLs use `HTTPS` or native URL schemes (i.e., `vipps://`), not `HTTP`. ALL URLs must match the exact URI sent on `/auth` request. No query parameters or additional trailing `/` can be included. |
| ### Use only required scopes Request only the scopes that you require, no "nice to have" scopes. If using national identity number, you must be granted access to request these scopes. See [Login: scopes](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md#scopes) for details. |
| ### Comply with our terms and conditions If you, as a merchant, will act on behalf of others (e.g., share data you have gotten from us with other merchants), ensure that you comply with our terms: * [Vipps MobilePay - terms and conditions](https://vippsmobilepay.com/en-NO/legal/terms-and-conditions) * [Vipps MobilePay - terms and privacy](https://vippsmobilepay.com/en-NO/legal/terms-privacy) |
| ### Follow design guidelines The branding must be according to the [Design guidelines](https://developer.vippsmobilepay.com/docs/knowledge-base/design-guidelines.md). Use the [button generator](https://developer.vippsmobilepay.com/docs/knowledge-base/buttons.md). |
| ### Include standard HTTP headers Send the [HTTP headers](https://developer.vippsmobilepay.com/docs/knowledge-base/http-headers.md) in all API requests for better tracking and troubleshooting (mandatory for partners and platforms, who must send these headers as part of the checklist approval). |
| ### Configure marketing consents (*Only required if you are collecting [consents](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/collecting-consents.md).*) Ensure that you have the correct terms and conditions and privacy URL set up if you are collecting [consents](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-configure-marketing-consents-for-login). |
| ## Security |
| ### Generate a `state` parameter Ensure that a unique [`state` parameter](https://developer.vippsmobilepay.com/docs/APIs/login-api/login-api-faq.md#whats-the-purpose-of-the-state-parameter) is generated for each `/auth` request. |
| ### Do not share `client_secret` Ensure that the `client_secret` is kept secret and is never shared to browsers or native apps. |

**TIP**

**Operational Status Page**

We recommend that you subscribe to the [Vipps MobilePay Operational Status Page](https://status.vippsmobilepay.com/) for real-time updates on service availability, incidents, and maintenance.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).