🇫🇷 Français | 🇬🇧 English
FAQ
General
What is LINLP?
L’Identité Numérique La Poste (LINLP) is a unique digital key accessible from your smartphone, allowing you to complete online procedures simply and securely.
It combines:
- certified identity verification performed beforehand
- a strong authentication solution
- controlled sharing of user data
👉 It allows users to securely prove their identity online.
What is the difference with FranceConnect+?
FranceConnect+ is an identity federation allowing access to various compatible public and partner services.
LINLP is an identity provider that can be used:
- directly by partners through dedicated integration
- within the FranceConnect+ ecosystem
Integration
Which protocol is used?
LINLP mainly relies on:
- OpenID Connect
- OAuth 2.0
Which flow do you recommend?
The recommended standard flow is:
Authorization Code
👉 It provides the highest level of security for web and application integrations.
Can LINLP be integrated on mobile?
Yes.
The following journeys can be supported depending on the chosen architecture:
- web
- mobile web
- mobile application
- cross-device journeys
Data
What data can be retrieved?
Depending on authorized scopes:
- pivot identity
- email
- phone number
- nationality
- documentary data
- account metadata
👉 See: Scopes and Claims
Is the preferred name reliable?
No.
The `preferred_username` field:
- is declarative
- freely entered by the user
- not verified by LINLP
👉 It must not be used as trusted reference data.
Is all data always returned?
No.
Returned data depends on:
- requested scopes
- authorized configuration
- user consent
- data availability
Security
Should the id_token be stored?
Yes.
The `id_token` constitutes:
- proof of authentication
- a signed token
- an element that can be verified afterwards
👉 It is recommended to retain it according to the partner’s internal policies.
Should the JWT be validated?
Yes, systematically:
- signature
- issuer
- audience
- expiration
- nonce (if used)
Can the client_secret be used on the frontend?
No.
⚠️ The `client_secret` is strictly confidential and must remain on the backend.
Testing
Is there a test environment?
Yes:
- Sandbox
- dedicated test accounts
How can credentials be obtained?
Submit a request to the LINLP team with:
- project context
- redirect_uri
- requested scopes
- designated owner
Do Sandbox credentials work in production?
No.
Each environment has separate credentials:
- Sandbox
- Production
UX
Is user consent always displayed?
No.
It appears only:
- during the first authentication on the service
- when new scopes are requested
- with the `prompt=consent` parameter
Does the user need their smartphone?
Yes.
Authentication relies on mobile validation through the LINLP application.
What happens if the user refuses?
The journey is interrupted and authentication does not succeed.