Sovos.com Contact Support

Get Started with Trust

Sovos Account

Authentication request examples

Construct authentication requests for each verification workflow in Sovos Account.

Discovery endpoint

To view available scopes and configuration, query the discovery endpoint:

CODE 
https://accounts.trust.sovos.com/.well-known/openid-configuration

The endpoint returns OpenID Connect configuration, including available scopes, authentication methods, and endpoint URLs.

Request parameters

All authentication requests use these parameters:

Parameter Description Example
acr_values Authentication workflow to use. Must be URL-encoded. urn:acr:moc-fpt
audience Specifies the intended resource server (API) for the access token. The generated token will only be valid for this audience, preventing token misuse across different services. https://api.yourapp.com
code_challenge PKCE code challenge value you generate from the code verifier. UzYUKJR0gIluJLktAGz...
code_challenge_method Hashing method for PKCE. S256 indicates SHA-256. S256
display How to display the authentication UI. page
nonce Random value to prevent replay attacks. Must be unique for each request. unique-nonce-value
prompt Controls when Sovos prompts for authentication and consent. login+consent
redirect_uri Where to redirect people after authentication. Must be URL-encoded and registered with your client. http://127.0.0.1:8081/callback
response_mode How the authorization response is returned. query
response_type Type of response requested. Use code for authorization code flow. code
scope Scopes you request, separated by spaces or plus signs. openid+offline_access
state Random value to prevent CSRF attacks. Must be unique and validated after redirect. pl8bgv6ytnel859554ebsmjw
ui_locales Preferred language for the authentication interface. es_CL
Important: Generate unique values for code_challenge, nonce, and state for each authentication request. Use your registered redirect_uri.

Fingerprint vs database validation (urn:acr:fpt)

Verify identity against centralized database records. Fingerprint validation compares captured fingerprints with stored biometric data in the database.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Afpt \
  -d client_id=your-client-id \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=a1b2c3d4e5f6g7h8i9j0k1l2 \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+profile \
  -d state=m2n3o4p5q6r7s8t9u0v1w2x3 \
  -d ui_locales=es_CL

Face vs database validation (urn:acr:face-vs-bd)

Verify identity by comparing a captured facial image against biometric records stored in the centralized database.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Aface-vs-bd \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=p3sr5cnfwhse9c162cr5f01r \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+offline_access \
  -d state=t3yq77dtftwknqz1nen5kksj \
  -d ui_locales=es_CL

Face vs Document validation (urn:acr:face)

Verify identity through facial recognition and document validation. This workflow captures the person's face and compares it against the photo on their identity document.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Aface \
  -d client_id=your-client-id \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=x3y4z5a6b7c8d9e0f1g2h3i4 \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+profile+email \
  -d state=j5k6l7m8n9o0p1q2r3s4t5u6 \
  -d ui_locales=es_CL

Face vs token validation (urn:acr:face-vs-token)

Verify identity by matching a captured facial image against a previously issued face token. This workflow confirms that the person presenting the token is the same individual whose biometrics were used to generate it.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Aface-vs-token \
  -d client_id=your-client-id \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=n3YpqY6jc339pQ9mbGgQs2tt \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+profile+email \
  -d state=m3yp7pf7jVycTf16186jc53b \
  -d ui_locales=es_CL \
  -d facedoc_token=your-toc-token

In addition to the general request parameters, this request also requires facedoc_token, the face verification token (toc_token) that your client saved after a successful face‑against‑document check.

Match-on-Card and fingerprint validation (urn:acr:moc-fpt)

Use this workflow for enhanced security through dual verification. It combines Match-on-Card technology with fingerprint database validation, verifying both the smart card chip data and the captured fingerprint against centralized records.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Amoc-fpt \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=o9s6dw50r98xj813cgtbifjg \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+offline_access \
  -d state=pl8bgv6ytnel859554ebsmjw \
  -d ui_locales=es_CL

Face vs Chilean ID validation (urn:acr:moc-face)

Verify identity by comparing a captured facial image against the photo stored on the Chilean identity card, using Match‑on‑Card technology to validate both the chip data and the biometric match.

CODE 
curl -XGET -G 'https://accounts-uat.trust.sovos.com/oauth2/auth' \
  -d acr_values=urn%3Aacr%3Amoc-face \
  -d code_challenge=UzYUKJR0gIluJLktAGz_jp0GXliMmSpk7cKP5cv8VJo \
  -d code_challenge_method=S256 \
  -d display=page \
  -d nonce=l5tp6cnfutyd9c524hf5p77b \
  -d prompt=login+consent \
  -d redirect_uri=http%3A%2F%2F127.0.0.1%3A8081%2Fcallback \
  -d response_mode=query \
  -d response_type=code \
  -d scope=openid+offline_access \
  -d state=j4ng63tdblefsyr6pst8osdld \
  -d ui_locales=es_CL
Public Implementation Identity Management Current

Last updated: October 14, 2026