> For the complete documentation index, see [llms.txt](https://docs.uaepass.ae/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.uaepass.ae/quick-start-guide-uae-pass-staging-environment/conduct-a-poc-with-uae-pass-authentication.md).

# Conduct a POC with UAE PASS Authentication

The following content provides you a step-by-step guide on conducting a simple POC with UAE PASS Authentication Feature using Postman.

## <mark style="color:orange;">Step 1</mark>

#### <mark style="color:blue;">Set up Staging UAE PASS Account</mark>

Before you begin you must set up a UAE PASS staging account following the steps given in <https://docs.uaepass.ae/start-test-environment-implementation/create-uaepass-user><mark style="color:green;">.</mark>

{% hint style="success" %}
**The account can be either basic or verified. UAE PASS Authentication feature will support SOP1, SOP2 and SOP3 user account types.**
{% endhint %}

## <mark style="color:orange;">Step 2</mark> &#x20;

#### <mark style="color:blue;">Invoke the Authorization Request.</mark>

&#x20;You can use following parameter values for POC purpose.

**Authorize Endpoint=** [<mark style="color:green;">https://stg-id.uaepass.ae/idshub/authorize</mark>](https://stg-id.uaepass.ae/idshub/authorize)

**Client\_id**= <mark style="color:green;">sandbox\_stage</mark>

**Scope** =  <mark style="color:green;">urn:uae:digitalid:profile:general</mark>

**Redirect\_uri**= <mark style="color:green;">For this POC we are using <https://localhost:8000>.</mark>

**acr\_values**= <mark style="color:green;">urn:safelayer:tws:policies:authentication:level:low</mark>

#### Sample Request

{% code overflow="wrap" %}

```url
https://stg-id.uaepass.ae/idshub/authorize?response_type=code&client_id=sandbox_stage&scope=urn:uae:digitalid:profile:general&state=HnlHOJTkTb66Y5H&redirect_uri=https://localhost:8000&acr_values=urn:safelayer:tws:policies:authentication:level:low 
```

{% endcode %}

{% hint style="danger" %}
Authorization request should be invoked in browser to obtain user authorization.
{% endhint %}

Once authorization request is invoked user will get the UAE PASS login page to authorize as follows.&#x20;

<figure><img src="/files/UfXAPhzYinOMCC6ukM1y" alt=""><figcaption><p><mark style="color:green;">UAE PASS Login Page</mark></p></figcaption></figure>

## <mark style="color:orange;">Step 3</mark>

#### <mark style="color:blue;">Enter the identifier of UAE PASS staging account (Email or Mobile or EID) and click on Login.</mark>

&#x20;Once you click on Login button you will receive the UAE PASS authentication notification request to the UAE PASS Staging mobile app and a notification request with a specific code in the browser.&#x20;

<figure><img src="/files/CBVuOrjf9YUXJZVl1Mic" alt=""><figcaption><p><mark style="color:green;">Enter Identifier and Click Login</mark></p></figcaption></figure>

<figure><img src="/files/dSwaqxHWHn91xkTXJ9ib" alt=""><figcaption><p><mark style="color:green;">Match the Code with Notification Request in Mobile</mark></p></figcaption></figure>

<figure><img src="/files/fmFhSf0aJVhhGSU4S9eC" alt=""><figcaption><p><mark style="color:green;">Mobile notification Screen</mark></p></figcaption></figure>

## <mark style="color:orange;">Step 4</mark>

#### <mark style="color:blue;">Select the correct code and confirm the notification request.</mark>

<figure><img src="/files/C6zn2V6FzMEvwCWozL22" alt=""><figcaption></figcaption></figure>

## <mark style="color:orange;">Step 5</mark>

#### <mark style="color:blue;">Obtain Authorization Code</mark>

Once the user accepts the notification request, UAE PASS will issue the authorization code in the response header as shown in below example.

#### Sample Response

```
https://localhost:8080/code-bbc69-344553dc-3445fdscc-HnfgmsfsjjH
```

<figure><img src="/files/PHDoSgfxUfhXzLJjVu0N" alt=""><figcaption><p><mark style="color:green;"><strong>Authorization Response</strong></mark></p></figcaption></figure>

## <mark style="color:orange;">Step 6</mark>

#### <mark style="color:blue;">Invoke the Access Token Request to obtain the access token.</mark>&#x20;

You can use following values for the POC.

**Token End point** = [<mark style="color:green;">https://stg-id.uaepass.ae/idshub/token</mark>](https://stg-id.uaepass.ae/idshub/token)

**grant\_type** = <mark style="color:green;">authorization\_code</mark>

**redirect\_uri** = <mark style="color:green;">Redirect URL value used in the authorization request (Step 2).</mark>

**code** = <mark style="color:green;">Authorization code received in authorization response.</mark>

**Authorization Header** = <mark style="color:green;">Base64 encoded (client\_ID : client\_Secret)</mark>

<figure><img src="/files/paWQ8L1CIZ1N0RiM000Y" alt=""><figcaption><p><mark style="color:green;">Token API request Parameters</mark></p></figcaption></figure>

<figure><img src="/files/td6XQicCOZOO5T7RoQaV" alt=""><figcaption><p><mark style="color:green;"><strong>Token API Authorization Header</strong></mark></p></figcaption></figure>

#### Curl Request for Token API

{% code overflow="wrap" %}

```
curl --location --request POST 'https://stg-id.uaepass.ae/idshub/token?grant_type=authorization_code&redirect_uri=https%3A%2F%2Flocalhost%3A8080&code=bbc69c3b-561b-3cc6-a590-16a2bb8448ed' \
--header 'Authorization: Basic c2FuZGJveF9zdGFnZTpzYW5kYm94X3N0YWdl'
```

{% endcode %}

{% hint style="danger" %}
Token request should be a back-channel request and should use postman or as CURL during the POC to invoke the request.&#x20;
{% endhint %}

{% hint style="success" %}
Authorization code is one time usage value and will expire once used to obtain an access token.  Expiry time will be 10 mins.
{% endhint %}

As success response you will receive an access token from UAE PASS as shown in below image.

<figure><img src="/files/SNCmAV4U9VP5TMQuJVfe" alt=""><figcaption><p><mark style="color:green;"><strong>Token API response</strong></mark></p></figcaption></figure>

## <mark style="color:orange;">Step 7</mark>

#### <mark style="color:blue;">Invoke the User Info request to obtain the user details of the authenticated user.</mark>&#x20;

You can use following values for the POC.

**User info Endpoint** = <mark style="color:green;"><https://stg-id.uaepass.ae/idshub/userinfo></mark>

**Bearer Token** = <mark style="color:green;">Access token value received from access token response</mark>.

<figure><img src="/files/IfWrBzbQUVGiFsLtSNgy" alt=""><figcaption><p><mark style="color:green;"><strong>User Info Request</strong></mark></p></figcaption></figure>

#### Curl Request for User Info API

```
curl --location 'https://stg-id.uaepass.ae/idshub/userinfo' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Bearer 221fb1c8-deb7-3fca-b9f6-1d18281f2929'
```

{% hint style="danger" %}
User Info request should be a back-channel request and should use postman or Curl during the POC to invoke the request.&#x20;
{% endhint %}

On success you will receive the user information of the authenticated user from UAE PASS.

<figure><img src="/files/GqNqb9azNz3ZdKgF52xZ" alt=""><figcaption><p><mark style="color:green;"><strong>User Info Response</strong></mark></p></figcaption></figure>

#### <mark style="color:blue;">You can download the postman collection for POC from below attachment.</mark>

{% file src="/files/FYfu6oua8jMuy6NKYwcy" %}