login-gov

Federal identity provider integration using login.gov. Covers OIDC (preferred) and SAML, private_key_jwt authentication, assurance level selection, and the full token exchange flow.

When to use

• Integrating a web or mobile app with login.gov for federal SSO
• Choosing between auth-only, identity-verified, and PIV/CAC assurance levels
• Implementing OIDC authorization code + private_key_jwt flow
• Setting up sandbox vs production environments
• Requesting user attributes (email, phone, SSN, x509/PIV)
• Debugging invalid_client, invalid_request, or token validation errors

Do NOT use for:

• Non-federal identity providers (Okta, Auth0, Cognito — use their own SDKs)
• SAML SP setup (login.gov supports SAML but OIDC is preferred; ask user to confirm)
• Private-sector applications (login.gov is US federal agencies only)