BankID & Vipps Research

BankID and Vipps Login Authentication Research

Research Date: 2026-02-15 Project: Drop Fintech App Purpose: Evaluate feasibility of integrating BankID and Vipps as authentication methods

Executive Summary

Both BankID and Vipps Login are viable authentication options for Drop. Both support OIDC/OAuth2 integration with Next.js, have test environments, and can serve dual purposes as both authentication and PSD2 Strong Customer Authentication (SCA).

Critical Timeline Note: BankID is undergoing major changes with an April 1, 2026 deadline for migration to new infrastructure.

Key Considerations:

1. Norwegian BankID

What is it?

BankID is Norway's leading electronic identification system, issued through Norwegian banks. It enables secure authentication and digital signatures. BankID supports both traditional methods and the newer BankID with Biometrics (app-based solution using WebAuthn).

Major Change in 2026: BankID is moving to a single issuer (Stø AS) with critical infrastructure changes taking effect April 1, 2026. All integrations must migrate to the new Digital Trust Platform and OIDC-based approach before this deadline.

Integration Method

Technical Requirements:

Reference Implementation: GitHub - BankID OIDC Integration Examples

Requirements to Get Access

Mandatory Prerequisites:

  1. Company must be a customer of a Norwegian bank (within BankID network)
  2. Person signing the contract must have personal eID (Norwegian BankID, Swedish BankID, or Danish MitID)
  3. Completed "Getting Ready for Production" guide (step 5) to obtain production domain
  4. Register application in BankID Developer Portal (freely available)

Application Information Required:

Agreement Process:

  1. Submit application information
  2. Provider sends online agreement for signing
  3. Signed agreement forwarded to your bank for processing
  4. Bank issues client credentials

Cost

Direct from BankID Norge (Reseller Model):

Via Idura/Criipto Aggregator:

NEEDS VERIFICATION: Direct BankID pricing may have changed. Contact BankID Norge for current 2026 pricing.

Technical Complexity

Difficulty Level: Medium

Pros:

Cons:

Estimated Integration Time: 2-4 weeks (including testing and certification)

Timeline

Application to Production:

Critical Dates:

Action Required: Complete migration to Digital Trust Platform before April 1, 2026.

Sandbox/Test Environment

Test Access: Freely available

Test Environment Details:

Testing Tools:

Support: developer@bankidnorge.no

PSD2 Relevance

SCA Compliance: YES - Fully compliant

BankID with biometrics is approved for payments and meets Strong Customer Authentication (SCA) requirements according to PSD2 and 3D Secure standards.

Technical Details:

Use Cases for Drop:

  1. User authentication/login
  2. PSD2 payment authorization (SCA)
  3. Combined auth + payment flow

Alternative Providers

Aggregator Services (Recommended):

  1. Idura (formerly Criipto)

    • Bundles BankID + Vipps + other Nordic eIDs
    • Single integration point for multiple providers
    • Pricing: €65-€390/month + per-transaction fees
    • Website: idura.eu

  2. Signicat

    • Largest BankID provider in Norway (established 2007)
    • Enterprise-focused solution
    • Offers authentication + digital signatures
    • Pricing: Contact for quote
    • Website: signicat.com

  3. Curity

    • Identity platform with Norwegian BankID support
    • OIDC authenticator approach
    • Enterprise-grade solution
    • Website: curity.io

Recommendation: For Drop's use case (fintech startup), Idura offers the best balance of simplicity, cost-effectiveness, and multi-provider support.

2. Vipps Login

What is it?

Vipps is Norway's #1 mobile payment provider with near-ubiquitous adoption. Vipps Login is an authentication service that allows users to log in using their mobile number. The brand split: Vipps (Norway/Sweden) and MobilePay (Denmark/Finland) use the same API under Vipps MobilePay.

Scope: Login API confirms customer identity and provides access to verified data: name, birthdate, social security number, address, email, phone number.

Integration Method

Implementation Example:

import NextAuth from "next-auth"
import Vipps from "next-auth/providers/vipps"

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [Vipps],
})

Test Mode Override:

Vipps({ issuer: "https://apitest.vipps.no/access-management-1.0/access/" })

Key Endpoint:

Requirements to Get Access

Application Process:

  1. Order product at vippsmobilepay.com
  2. Complete "Login checklist" for direct integration
  3. Partner application review
  4. Receive test credentials via email (test phone number + national identity number)

Company Requirements:

Technical Setup:

Cost

Per-Transaction Pricing:

Via Idura Aggregator:

Notes:

Technical Complexity

Difficulty Level: Low-Medium

Pros:

Cons:

Estimated Integration Time: 1-2 weeks

Timeline

Application to Production:

Recommendation: Contact Vipps developer support for exact onboarding timeline.

Sandbox/Test Environment

Test Environment: Merchant Test (MT) - Available to all API merchants

Access Details:

Test User Credentials:

Limitations:

Suitable For: Websites, e-commerce, apps, loyalty programs

PSD2 Relevance

SCA Compliance: YES - Fully compliant

Vipps has implemented PSD2-compliant Strong Customer Authentication with regulatory-approved delegated SCA from card issuers.

Technical Details:

Use Cases for Drop:

  1. User authentication/login
  2. PSD2 payment authorization
  3. Simplified payment flow (no separate 3DS step needed)

Advantage: Vipps SCA is transparent to users (already authenticated in app), creating smoother UX than traditional 3DS flows.

Alternative Providers

Same aggregators as BankID:

  1. Idura (formerly Criipto)

    • Bundles Vipps with BankID and other eIDs
    • Single integration, multiple auth methods
    • Transparent pricing model

  2. Signicat

    • Enterprise solution
    • Combined authentication suite
    • Contact for pricing

Recommendation: If implementing both BankID AND Vipps, use Idura aggregator to manage both via single integration point.

3. Aggregator Comparison

Why Use an Aggregator?

Benefits:

  1. Single integration point for multiple eID providers
  2. Simplified SDK/API (abstraction layer)
  3. Unified billing and reporting
  4. Faster time-to-market
  5. Reduced maintenance burden
  6. Future-proof (easy to add more eID methods)

Trade-offs:

  1. Additional monthly platform fee (€65-€390)
  2. Dependency on third-party service
  3. Potential slight latency increase

Idura (Criipto) - Recommended

What is it: European eID verification platform (formerly Criipto, rebranded to Idura)

Supported eIDs:

Pricing Structure:

Technical:

Best For: Drop's use case - need both BankID + Vipps with potential Nordic expansion

Signicat - Enterprise Alternative

What is it: Europe's largest eID and signature provider (established 2007)

Position: Largest BankID provider in Norway

Pricing: Contact for quote (not publicly listed)

Best For: Large enterprises, complex compliance needs, high-volume applications

Direct Integration vs Aggregator

For Drop, Recommend: Idura Aggregator

Reasoning:

  1. Supports both BankID and Vipps through one integration
  2. Transparent pricing (€140/month Medium tier likely sufficient)
  3. Future-proof for Nordic expansion
  4. Faster development (proven SDK)
  5. Lower maintenance burden
  6. Cost-effective at expected volume (<10,000 logins/month)

Break-even Analysis:

4. Implementation Recommendations

Phase 1: Email + Password (MVP)

Phase 2: Add BankID (Primary eID)

Phase 3: Add Vipps Login (Alternative)

Phase 4: Optimize Flow

Technical Architecture

Next.js 16 App Router
├─ Auth.js (NextAuth v5) - OIDC client
├─ Idura Verify - eID aggregator
│  ├─ Norwegian BankID
│  └─ Vipps Login
├─ jose - JWT signing/verification
└─ PostgreSQL - user sessions

Flow:

  1. User clicks "Log in with BankID" or "Log in with Vipps"
  2. Next.js redirects to Idura OIDC endpoint
  3. Idura redirects to BankID/Vipps
  4. User authenticates
  5. Idura returns to callback with ID token
  6. Next.js validates token, extracts claims (name, SSN, email)
  7. Create/update user in database
  8. Issue JWT session token (jose)
  9. User authenticated

Security Considerations:

Timeline Estimate

Development Timeline:

Total: 8 weeks to production-ready dual eID authentication

Cost Projection (First Year)

Assumptions:

Calculation:

At Scale (10,000 users):

Conclusion: Cost scales linearly with users, remains affordable for fintech startup.

5. Risks and Mitigations

BankID Migration Risk (Critical)

Risk: April 1, 2026 deadline for Digital Trust Platform migration

Impact: Service disruption if not migrated in time

Mitigation:

Age Verification Accuracy

Risk: Users might bypass age check with email/password

Mitigation:

User Adoption

Risk: Users unfamiliar with eID login may abandon signup

Mitigation:

Service Availability

Risk: BankID/Vipps downtime prevents login

Mitigation:

Regulatory Changes

Risk: PSD2/eIDAS requirements may change

Mitigation:

6. Questions Needing Verification

The following points require direct contact with providers for confirmation:

  1. BankID Direct Pricing: Current 2026 per-transaction costs (NOK 8,300/month model unclear on variable costs)
  2. Vipps Timeline: Exact onboarding timeline from application to production
  3. Vipps Active Users Model: Current 2026 pricing structure for active users billing
  4. Idura Large Tier: Volume thresholds for Small/Medium/Large tiers
  5. Minimum Requirements: Specific business registration requirements for Vipps merchant account
  6. SCA Dual-Use: Confirm BankID/Vipps can be used for BOTH login and payment authorization in same session
  7. April 2026 Migration: Detailed requirements if integrating direct BankID (not via aggregator)

7. Final Recommendation

Recommendation: Implement BOTH BankID and Vipps via Idura aggregator

Justification:

  1. Regulatory Compliance: BankID satisfies identity verification (18+, Norwegian resident)
  2. User Preference: Vipps more familiar, offers free login option
  3. PSD2 Dual-Use: Both serve as authentication AND SCA for payments
  4. Cost-Effective: Idura cheaper than direct integration until high volume
  5. Risk Mitigation: Idura handles April 2026 BankID migration
  6. Future-Proof: Easy to add Swedish/Danish eIDs for Nordic expansion
  7. Development Speed: Faster implementation with proven SDK

Implementation Priority:

  1. Phase 1: Email/Password (MVP launch)
  2. Phase 2: BankID via Idura (compliance requirement)
  3. Phase 3: Vipps via Idura (user convenience)

Next Steps:

  1. Contact Idura sales for Medium tier quote and setup
  2. Register test account and explore SDK documentation
  3. Validate integration with Next.js 16 App Router
  4. Architect user database schema (with eID verification fields)
  5. Implement BankID flow first (higher priority for compliance)
  6. Add Vipps as alternative option
  7. Load test authentication flow
  8. Production deployment with monitoring

Sources

BankID Sources

Vipps Sources

PSD2/SCA Sources

Aggregator Sources

Report Prepared By: John (AI Director) Last Updated: 2026-02-15 Status: Research complete, awaiting approval for implementation

Revision #5
Created 2026-02-18 08:44:55 UTC by John
Updated 2026-05-25 07:26:18 UTC by John