> **Description:** Find answers to frequently asked questions about implementing and using the Login API.

# Frequently asked questions

Here are the Login API Frequently Asked Questions (FAQ).
See the [Login API](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/README.md) for all the technical details.

## Setup and configuration

### Why does Login fail for my sales unit?

Make sure that your test sales unit is set up for using login.
See [How to set up login on your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).

### Where do I find the `client_id` and `client_secret`?

See:
[General info: API Keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md#getting-the-api-keys).

### How can I activate and set up Login?

You can activate Login on the [business portal](https://portal.vippsmobilepay.com).
See [How to set up login on your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).

### Can I initiate payments using a Login sales unit?

If you ordered a sales unit specifically for Login, you won't be able to complete payments with it. It's also not possible to add a payment solution to this sales unit later on.
However, you can set up Login for all ecom sales units in order to handle both Login and payments from the same sales unit. So if your intention is to do so, please order an ecom sales unit and activate Login afterwards on the [business portal](https://portal.vippsmobilepay.com).

See [How to set up login on your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).

### How can I use `client_secret_post` for authentication?

It is possible to change the token endpoint authentication method on the
[business portal](https://portal.vippsmobilepay.com).
This setting will then apply to all login transactions on this sales unit.

Here you have the option to change the token endpoint authentication method,
and see which method is currently active: `client_secret_basic` or `client_secret_post`.

See [How to set up Login for your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).

## Redirect URIs and Callbacks

### What are the requirements for redirect URIs and app callback URIs?

We validate redirect URIs used against a whitelist of
pre-approved URIs. The URIs must be registered by the merchant on the
[business portal](https://portal.vippsmobilepay.com)
as described in [How to set up login on your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).

You can register as many URIs as you want. Specify the URI that will be used with
the query parameter, `redirect_uri`, on the initial request to the `authentication`
endpoint.

The `app_callback_uri` should be a URI that makes the device switch back to the merchant's app again after the Vipps/MobilePay app portion of the flow is done (example: `https://example.com/app/callback`).

For app URIs, we recommend using universal links (Apple)/asset links (Android) instead of custom URL schemes for better security.

**Please note:**

* The redirect URI cannot contain `#`.
* You can use `localhost` as part of the redirect URI.
* If the `redirect_url` is using a custom URL scheme, such as `myapp://`, a path
  is required: `myapp://path-to-something`.

### Can we have multiple URIs as landing pages?

Yes. You can register as many callback URLs as you want; and then you specify which
one you use in the request to
[`GET:/access-management-1.0/access/oauth2/auth`](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml).

### Can I use a custom URL scheme for the `redirect_url`?

Yes. If the `redirect_url` is using a custom URL scheme, such as `myapp://`, a path
is required: `myapp://path-to-something`.

## Errors and troubleshooting

### Why do I get `invalid_client`?

This means that the specified `client_id` and `client_secret` are not valid for Login.

Please check:

* Have you activated Login and set up a redirect URI? See:
  [How to set up login on your sales unit](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-set-up-login-for-your-sales-unit).
* Have you double-checked that the `redirect_uri` used in the API call is
  *exactly* the same as the one specified on the
  [business portal](https://portal.vippsmobilepay.com)?
* Pay extra attention to whether the URI used in the API request has a
  trailing `/` or URL-encoded entities (like `%20`), and whether the URI added on the
  [business portal](https://portal.vippsmobilepay.com)
  is an exact match.
* Are you using the `client_id` and `client_secret` for the correct environment?
  There are separate API keys for test and production. See:
  [General info: API Keys](https://developer.vippsmobilepay.com/docs/knowledge-base/api-keys.md).

### Why do I get `invalid_grant`?

The most common reason is that the authorization code has expired.
The code is short-lived, so it will only be valid for a couple of minutes.

From
[RFC 6749](https://www.rfc-editor.org/rfc/rfc6749#section-5.2):

> The provided authorization grant (e.g., authorization code, resource owner credentials)
> or refresh token is invalid, expired, revoked, does not match the redirection URI used
> in the authorization request, or was issued to another client.

If you first make one request, and then repeat the same request, you will get this error.

### Why do I get `invalid_request`?

The most common reason is that the `redirect_uri` sent in the API request is not identical
to one of the URIs registered by the merchant on the [business portal](https://portal.vippsmobilepay.com).

The `redirect_uri` must be an exact match, including capitalization and query string.
It must be 100 % identical.

Please check that you are including all required parameters in the API request.

### Which scopes can I use? Why do I get `invalid_scope`?

If you get `Invalid_scope` this means that you have included one or more scopes
that you do not have access to or that are not supported.
See: [API guide: Scope](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md#scopes).

### Why do I get `Error: Could not get Login token" in Vipps`?

You can get this error if you have both our
[test app](https://developer.vippsmobilepay.com/docs/knowledge-base/test-environment.md#test-apps)
and production app on the same phone.

### Why do I get `The client or its related sales unit or merchant does not exist or is not active`?

This means that the API credentials are for a Merchant Serial Number (MSN)
that does not exist, or is not active. This can happen if the organization number
has been deactivated in the national business registry.

### Why do I get a CORS error?

We do not currently support any flows that require requests being made from browsers.

If you get a CORS (Cross-Origin Resource Sharing) error, this is typically a client-side
configuration issue, not an error from Vipps MobilePay. This usually happens when attempting to call
an API from a website, where your web server's configuration prevents the cross-origin request.

CORS is a protocol that enables scripts running on a browser client to interact
with resources from a different origin. Sometimes servers are configured to
prevent this, and that results in a CORS error.

We only receive the API requests over HTTPS, and we have no way of detecting
how the request was made on the caller side - it all looks the same.
We cannot fix the CORS error for you.

You can read more about CORS here:
[CORS Tutorial: A Guide to Cross-Origin Resource Sharing](https://auth0.com/blog/cors-tutorial-a-guide-to-cross-origin-resource-sharing/).

### Why do I get `No CSRF value available in the session cookie`?

Certain versions of Chrome give the error `No+CSRF+value+available+in+the+session+cookie`.
Upgrading to the latest version of Chrome should solve this.

### Why do I get `HTTP 502 Bad Gateway`?

Some merchants have experienced a 502 Bad gateway response from [api.vipps.no](https://api.vipps.no).
This typically occurs in situations in which the `state` or `nonce` parameter
is 1000+ characters. We've seen this issue when any of the requests in the
redirect sequence are too long (i.e., 2000+ characters). Therefore, try to keep
these parameters at sane lengths. If there is a need to encode some payload in
the `state` (i.e a JWT), it would be a better option to cache this at the
client server and use the key as `state`.

See
[FAQ: Common errors](https://developer.vippsmobilepay.com/docs/knowledge-base/errors.md)
for more questions.

## User information and scopes

### What is the `sub`?

The `sub` is a unique identifier for a user and relates to their consent to share information.

For details, see:
[API Guide: Sub](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md#sub).

### How can I get updated information, like addresses, for a user?

See:

* [Userinfo](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md)

### Who can get access to NIN and how?

See [Login API userinfo: `nin`](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/user-info.md#nin).

## Features and behavior

### Can a user less than 15 years old use Login?

No, Login requires a full Vipps or MobilePay profile. Users below the age of 15 can
not use Login.

To log in with Vipps or MobilePay, you need to be at least 15 years old.

### How can we detect users' consent removal?

Or: *How can our system dynamically "know/find out" if the user has revoked the consent
for us to have access to his/her personal data in our system?*

Your system can dynamically detect when a user's consent has been revoked by using *consent webhooks*.
This is a system for notifying merchants when an end user revokes their consent.
See the
[Consent webhooks](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/webhooks.md#revoke-consent-webhooks) section for more information.

### What's the purpose of the `state` parameter?

The `state` parameter is an opaque value used by the client to maintain state
between the request and callback. The authorization server includes this value
when redirecting the user-agent back to the client. The parameter should be
used for preventing cross-site request forgery. It must be at least 8 characters long
to ensure sufficient entropy. A GUID is a good choice for a state parameter value.

### Can I use partner keys for Login?

Yes, partner keys can be used for both *Login in Browser* and *Merchant-initiated login*.
Be aware that the partner key integration
[differs slightly from a regular merchant integration](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/partner-keys.md).

Login supports some scenarios where a merchant can be used for registration and
log in to other sites/merchants. Specific
[terms and conditions](https://vippsmobilepay.com/en-NO/legal/terms-and-conditions) related to
UX/branding, consent, terms, and privacy statement apply to such scenarios.

### How is GDPR handled with Login?

With regard to the processing of personal data and GDPR, the following applies
to Login:

1. Login gives a merchant the opportunity to ask a Vipps or MobilePay end user to share
   a selection of data from their profile in Vipps. This can include name, phone
   number, email, addresses, and date of birth. The merchant controls which of
   this data is requested. The user must consent to the sharing of data.
   The consent is the legal basis for the Vipps MobilePay AS (hereafter called Vipps MobilePay) transfer of
   this information to the merchant.
2. We are responsible for our processing of information related to our
   end users and the personal information generated using the Vipps MobilePay services.
   For the Login service, the merchant will be responsible for the
   processing of the profile information received, starting when the merchant
   receives the profile information from Vipps or MobilePay end user. The merchant will thus
   be an independent data controller for this data, and there is no need for a
   data processing agreement between Vipps MobilePay and the merchant.
3. The merchant must therefore obtain a valid basis for further processing of
   the personal data (e.g., agreement, terms or consent), to e.g. register the
   information in its customer register and start customer processing from there.
4. When such sharing from Vipps MobilePay to the merchant has been made, the end
   user can later use our services to log in to the merchant, and the merchant will
   then have access to updated information on the data elements that the company
   has requested. A Vipps MobilePay end user can go into the Vipps or MobilePay app and see which
   companies they have shared data with, which data has been shared, and they
   can withdraw their consent to share. This means that new consent must be
   obtained before we can share data again with the merchant.
5. When an end user uses Login at a merchant, we store, as part
   of our service to the end user and with Vipps MobilePay as data processor,
   information about (a) what information a user has agreed to share with a
   merchant and (b) when a user has used Vipps MobilePay to log in to the relevant merchant.
6. Vipps MobilePay does not receive any information from the merchant about a Vipps MobilePay end user.

See more information in our
[privacy policy](https://vippsmobilepay.com/en-NO/legal/terms-privacy)
and
[terms and conditions](https://vippsmobilepay.com/en-NO/legal/terms-and-conditions).

### Can we control the language displayed to the user?

No. The language is controlled by the browser settings.

Specifically, language is controlled by `window.navigator.language`; however, it gets more complicated
since there are fallbacks. Refer to the documentation for your browsers.

### How can I log a user out?

*Login* does not support merchant-initiated log-out in the browser, as this
would effectively log the user out of Vipps MobilePay (meaning that the user will no
longer be remembered in the browser across sites that use Login). You
are of course free to log the user out of your service (by disabling your own session).

If a user wants to log out of a specific browser remembered in Login, they need to do this in the Vipps or MobilePay app by navigating to:
*Profile* > *Personal Information* > *Browsers that remember you*, select a browser, and press the *logout* button.

## Portal configuration

### Can we change the name that appears in customer's app under `Login and Access`?

The name which is displayed in the customer's Vipps or MobilePay app is the name of the sales unit.
You can change it yourself on the
[business portal](https://portal.vippsmobilepay.com).
See [How can I change my name and logo?](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-can-i-change-my-name-and-logo)

### Can we receive user info in the ID token?

Yes, it is possible to configure whether the ID token includes userinfo on the [business portal](https://portal.vippsmobilepay.com).

For more information, see [ID token user info](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/core-concepts.md#id-token-user-info).

### Can we change the text that is displayed in the app during Merchant-initiated logins?

Yes. You can select between the following texts:

* "Join customer club"
* "Share information"
* "Confirm information"

To do this, update the login settings for your sales unit on the [business portal](https://portal.vippsmobilepay.com).

See [Portal: How to configure text for merchant initiated login flow](https://developer.vippsmobilepay.com/docs/knowledge-base/portal.md#how-to-configure-text-for-merchant-initiated-login-flow).

## Integration-specific

### Which configuration should I have when integrating using Azure B2C?

Azure B2C overrides the `redirect_uri` parameter to redirect to Azure B2C first, then to your redirect URI.
You will need to look at your call to `https://apitest.vipps.no/access-management-1.0/access/oauth2/auth`
and find the `redirect_uri` query parameter. This will need to be whitelisted on the
[business portal](https://portal.vippsmobilepay.com).

See [What are the requirements for redirect URIs and app callback URIs?](#what-are-the-requirements-for-redirect-uris-and-app-callback-uris)

Azure B2C uses `client_secret_post` as `token_endpoint_auth_method` and the default value is
`client_secret_basic`, so you'll need to change this on the [business portal](https://portal.vippsmobilepay.com).

See [How can I use `client_secret_post` for authentication](#how-can-i-use-client_secret_post-for-authentication).

Login does not return user information in the `id_token`, but there is a
[userinfo endpoint](https://developer.vippsmobilepay.com/redocusaurus/login-swagger-id.yaml)
for this use case. See
[the Login API userinfo endpoint documentation](https://developer.vippsmobilepay.com/docs/APIs/login-api/api-guide/browser-flow-integration.md#userinfo).
Azure B2C's User Flows does not use the userinfo endpoint, and you will therefore need
to use a [Custom policy](https://docs.microsoft.com/en-us/azure/active-directory-b2c/userinfo-endpoint?pivots=b2c-custom-policy).

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).