Skip to content
GBG Documents & Biometrics Documentation

Authentication

Every request to an IDscan Core service carries a JSON Web Token (JWT) in the Authorization header, using the Bearer scheme:

Authorization: Bearer <your token>

A request without a valid token is refused with 401 Unauthorized.

Getting a token

Section titled “Getting a token”

Tokens are issued to your account by GBG’s authentication service. How to obtain one, how long it lasts and how to refresh it are described in the IDscan Core Authentication Guide, which your GBG support representative sends you with your credentials. The liveness and biometrics services are covered by the Documents and Biometrics Liveness Guide in the same way.

If you do not have the guide, ask your GBG contact or contact support.

Keeping tokens safe

Section titled “Keeping tokens safe”
  • Obtain and use tokens on your own server. Never embed credentials or tokens in a browser page or a mobile app.
  • Treat a token like a password: do not log it, do not put it in a URL, and do not share it in a support ticket.
  • Use the token for the region your account was set up in. A token for one region is not valid in the other.

Identifying your requests

Section titled “Identifying your requests”

Send your own reference with each request, either as the x-correlation-id header or as the CorrelationId field of the form. The service returns it as correlationId in every response, including error responses, so that you can match a result to your own records and quote it to GBG support when you need help.