Vipps Authentication
Feature Detail
Description
Vipps authentication integrates the widely-adopted Norwegian mobile payment identity platform as an alternative OAuth login path alongside BankID. Unlike BankID, the Vipps identity response includes the national registration number, enabling organizations to retroactively populate membership records where this field is currently blank. The feature shares the Auth Provider Config infrastructure with BankID and targets the same Phase 2 rollout. Users who prefer Vipps - common among younger demographics - receive a familiar, low-friction login experience without managing a separate password.
Sources & reasoning
Same phase evidence as BankID (Fase 2 = v1.0). The unique business value - returning national registration numbers to membership systems - is documented explicitly in §1.3, justifying a separate feature entry. Cost sharing noted in §6 is a concrete operational detail that confirms organizational commitment to this feature.
No source references — this artifact was included based on reasoning alone (see above).
Analysis
The Vipps login response includes the national registration number, directly solving a data quality gap where many membership records lack this identifier, which complicates Bufdir reporting and identity verification across all four organizations. Vipps adoption in Norway is near-universal among smartphone users, reducing login friction for the volunteer demographic and improving retention. The API subscription cost of 350-750 NOK per month is shared across organizations, making it economically viable at modest per-tenant cost. First-time Vipps login establishes the strong identity link that subsequent biometric session unlocks rely on.
Vipps uses an OIDC-compatible OAuth 2.0 flow handled by the Authentication Module, reusing the same provider abstraction as BankID with a provider_type discriminator in Auth Provider Config. The national registration number from the identity token is stored encrypted and linked to the user record. Flutter handles the Vipps deep-link redirect identically to BankID. A separate Vipps Login merchant agreement and production key provisioning must be initiated in parallel with BankID certification during Phase 1. The cost-sharing model among organizations requires an operational agreement before Phase 2 launch and should be tracked per-tenant for billing transparency.
Components (45)
Shared Components
These components are reused across multiple features
Service Layer (11)
Data Layer (23)
Infrastructure (7)
User Stories
No user stories have been generated for this feature yet.