Purpose
When a citizen signs in, eID issues OIDC ID tokens that include acr (authentication context), amr (authentication methods), and auth_time (when authentication occurred). SXM brokers SSO to government apps; relying parties read these claims to understand how strongly the user was authenticated.
Assurance levels
Substantial assurance
Citizen authenticated with password plus a second factor (SMS OTP or authenticator app). This is the default assurance level for government sign-in after MFA.
https://eid.gov.sx/loa/substantialHigh (LoA 3)High assurance
Citizen authenticated with a FIDO2 passkey (WebAuthn). Phishing-resistant hardware or platform authenticator.
https://eid.gov.sx/loa/highSubstantial — SSOSubstantial assurance (SSO resume)
Citizen reused an existing eID portal session to access another application without repeating MFA. The original authentication time is preserved in auth_time.
https://eid.gov.sx/loa/substantial-ssoAuthentication methods (amr)
| amr | Meaning |
|---|---|
pwd | Password verified |
sms | SMS one-time password (MFA) |
otp | TOTP authenticator app (MFA) |
hwk | Hardware key / passkey (WebAuthn) |
session | Existing portal session reused (SSO resume) |
recovery | MFA recovery flow completed |
OIDC claims
| Claim | Description |
|---|---|
acr | Authentication Context Class Reference — LoA URI for this login |
amr | JSON array of authentication methods used (e.g. pwd, sms, hwk) |
auth_time | Unix timestamp when the user authenticated |
Machine-readable metadata: OIDC discovery document lists acr_values_supported and claims_supported.
Identity vs authentication assurance
- Identity assurance (IAL) — PSC enrolment, document verification, UIN/eID issuance.
- Authentication assurance (LoA) — login and MFA at sign-in (this policy).
High identity assurance at enrolment does not replace LoA at login; both apply.