BankID integration

The happy path is simple: the user starts, opens the app, enters their code and is in. It is also the path that gets tested first, because it is the one that gets demonstrated. The work is in everything that does not go to plan.

What has to be handled

• The user cancels in the app, or closes it without cancelling.
• The order expires before the user finds their phone.
• Login started on a computer and finished on a phone, or the other way round.
• Two tabs open, each with a signing in progress.
• The app is not installed, or is a version that behaves differently.

Each of them needs a clear state in your system and a way forward for the user. The order should be owned by the server and tied to the session: if the user starts a new order, the old one should be cancelled, and the result should be checked on the server before anyone is let in. If you rely on the browser to keep track of which order is current, you have a bug that is hard to trace.

Signing is not the same as login

When signing, keep exactly the text the user saw and signed, together with the signature and the revocation check response BankID returns. Store it on the server, tied to the right order and the right user, and check there that the result belongs to the order you started. A “yes” in a database column is not enough the day someone disputes the agreement. How long the evidence must be kept is a legal question for your business. The format should stay readable for as long as it applies.

How long does a BankID integration take?

That depends on how many flows you need. Same device, other device and BankID by phone, when someone identifies themselves during a call, are three different flows with different test cases, and signing is a separate piece of work on top of login. We write tests for the state handling with simulated responses, run the flows against BankID’s test environment with test identities, and test the app switching by hand on real phones. If you also need to take payment, payment integration is separate work that can be part of the same project.