🇫🇷 Français | 🇬🇧 English
Token Validation
Objective
Explain how to validate the tokens returned by L’Identité Numérique La Poste.
👉 Token validation is mandatory to guarantee authentication security.
Relevant Tokens
The main returned tokens are:
| Token | Usage |
|---|---|
| id_token | Proof of authentication |
| access_token | API access |
⚠️ The `id_token` must always be validated.
Mandatory id_token Checks
The partner must verify the following elements:
| Check | Description |
|---|---|
| Signature | Verify that the token was signed by LINLP |
| iss | Verify the expected issuer |
| aud | Verify that the token is intended for your client |
| exp | Verify that the token has not expired |
| iat | Verify time consistency |
| nonce | Verify if used during the flow |
Signature Validation
LINLP publishes its public keys through the endpoint:
/auth/realms/partenaire/protocol/openid-connect/certs
👉 Standard format: JWKS
The partner must:
- retrieve the key matching the `kid`
- verify the JWT signature
Issuer Validation
The `iss` field must match the environment in use.
Example:
| Environment | Expected Value |
|---|---|
| Sandbox | https://authent.pprod.lidentitenumerique.laposte.fr |
| Production | https://authent.lidentitenumerique.laposte.fr |
Audience Validation
The `aud` field must match your:
client_id
👉 Otherwise, the token must be rejected.
Expiration Validation
The field:
exp
represents the token expiration time.
⚠️ An expired token must not be accepted.
Nonce Validation
If a `nonce` was sent during `/authorize`:
👉 The same `nonce` must be present in the token.
This protects against certain replay attacks.
Example Payload
{
"iss": "https://authent.lidentitenumerique.laposte.fr",
"aud": "client_abc",
"sub": "5577832670193",
"exp": 1712345678,
"iat": 1712342078
}
Recommendation Regarding the id_token
⚠️ The `id_token` may be retained as historical proof of authentication.
👉 Its expiration concerns real-time usage, not its evidentiary value.
access_token Validation
The `access_token` is used to call:
/userinfo
👉 The partner must treat it as a temporary secret.
Key Takeaways
- The `id_token` must always be validated
- Signature + iss + aud + exp = minimum required checks
- LINLP public keys are published through JWKS
- The `id_token` should be retained as evidence
Next Step
👉 Frequently asked questions: