The shopper page
Our page runs the eID check. Your app only sends the shopper there and handles their return.
What the shopper sees
The shopper opens the verifyUrl, sees the shop's name and the age being checked, enters a phone number or kennitala, and approves in their eID app. The page then shows the outcome and returns them to your returnUrl.
The link is the shopper's only credential: it is unguessable, stored by us only as a hash, expires 30 minutes after it was made, and allows at most 3 eID starts. An unknown, malformed or expired link all look the same (404).
The return
We redirect to your returnUrl with one query parameter, abyrg_verification=<verification-id>. The result is never in the URL: a shopper could edit it. Read it from GET /api/v1/verifications/{id} with your own credentials, and check that the id is one you started for this cart.
A shopper who closes the tab can come back to the same link while it is valid. If the Verification ends as rejected or timeout and starts are left, the page lets them try again.
Testing on a test tenant
On a test tenant the page accepts only the test identifiers from Test mode; no phone is prompted.
| Identifier | Outcome |
|---|---|
0000000001 | An adult, so result: pass. |
0000000004 | Aged 16, so result: fail at 17+. |
0000000002 | rejected |
0000000003 | timeout |
The page is protected against bots; run it in a real browser, not a script. Problems: Errors.