Quick Login identity response

Browser-only mode delivers this information as the data of SignatureReceived. Backend mode POSTs it to the registered callback and includes SessionId for correlation. Field names are case-sensitive.

Identity fields

Field	Meaning
`Id`	Legal Identity identifier.
`Provider`	Identity’s trust provider.
`State`	Identity state; evaluate it against your application’s acceptance rules.
`Created`, `Updated`	Creation and update timestamps; `Updated` may be null.
`From`, `To`	Identity validity interval.
`ClientKeyName`	Client signature algorithm name.
`HasClientPublicKey`, `ClientPubKey`	Whether the client public key is present, and its Base64 value.
`HasClientSignature`, `ClientSignature`	Whether the client signature is present, and its Base64 value.
`ServerSignature`	Base64 server signature.
`Properties`	Identity property names and values. Do not assume every identity has the same keys.
`Attachments`	Attachment metadata and access URLs. May be empty.
`SessionId`	Backend correlation value originating in the registration’s `sessionId`.
`Key`	Quick Login key shown in the provider’s identity schema; treat it as sensitive if present.

The deployed browser client interprets timestamps as Unix seconds, using new Date(1000 * value). The upstream diagram labels them as date/time values. Verify the received representation when integrating a different provider or version. For example, a subset of a response might look like this. Identifiers and property values below are illustrative; additional signature and attachment fields are omitted:

{
  "Id": "<LEGAL_ID>",
  "Provider": "<TRUST_PROVIDER>",
  "State": "Approved",
  "Created": 1767225600,
  "Updated": null,
  "From": 1767225600,
  "To": 1798761600,
  "Properties": { "FIRST": "Alex", "LAST": "Example" },
  "Attachments": []
}

Attachments

Each attachment can include Id, ContentType, FileName, Signature, Timestamp, Url, and BackEndUrl.

Url is the direct download location and requires Neuro authentication.
BackEndUrl provides access through Quick Login following approval. Treat it as a sensitive access URL; do not publish it, persist it in analytics, or assume permanent availability.
Signature is the client’s signature of the attachment contents.

Avoid automatically fetching attachments just to display a login result. Render returned strings as text, validate URLs before navigating, and use your provider’s verification rules before trusting downloaded content. The live demo displays JSON without downloading attachments.

Use identity information safely

An identity identifier is not an Agent API JWT. Receiving a result does not grant application permissions. Validate the accepted provider, identity state, validity interval, and required properties before linking it to an application user. Keep personal data only as long as your application needs it. Do not use a browser-submitted copy of this JSON as proof of a backend login; use backend delivery or Neuron sessions. Sources: identity information schema and reference response rendering.

Start here

Integrate

Reference

Identity fields

Attachments

Use identity information safely

​Identity fields

​Attachments

​Use identity information safely

Identity fields

Attachments

Use identity information safely