Vipps Authentication

high complexity extracted Authentication & Access Control Confidence: 100%

Components

Shared

User Stories

Yes

Analyzed

Description

Vipps is Norway's dominant mobile payment and digital identity platform, with near-universal adoption among the target user demographic. This feature allows users to authenticate using their Vipps account via the Vipps Login API (OpenID Connect), providing a familiar one-tap experience on mobile. Like BankID, Vipps login is backed by a verified Norwegian phone number and can return the national identity number on first authentication. It specifically targets peer mentors who use Vipps daily and prefer not to manage separate app credentials.

Analysis

Business Value

Vipps adoption among the target demographic makes it the lowest-friction identity option for mobile-first peer mentors with limited digital confidence. Offering Vipps alongside BankID maximizes the share of users who can authenticate without a separate password, reducing onboarding dropout in the population most likely to abandon a registration flow mid-way. Like BankID, Vipps supplies the personnummer on first login, improving member record completeness without additional data collection steps. Operating cost of 350-750 NOK/month is shared across participating organizations, making per-tenant impact negligible.

Implementation Notes

Vipps Login uses the Vipps Login API (OpenID Connect), which is distinct from the payment API and requires a separate merchant agreement. The Authentication Module adds /auth/vipps/initiate and /auth/vipps/callback endpoints, parallel to the BankID flow and sharing the same downstream session issuance logic. The callback extracts the sub claim as the unique Vipps user ID and optionally the national identity number if the nnin scope is granted. The integration reuses the same provider extension point and Phase 2 feature flag as BankID, so both providers can be enabled or disabled independently per environment.