Most people encounter digital ID not as a system in itself, but through the moments in which they rely on it – a new bank account needs to be opened, a benefit needs to be collected, or a transaction needs to be completed online. Each time, there is a point during which the system has to answer a critical question with utmost confidence: is this person who they claim to be?
That is the role of authentication. While the question seems straightforward, the environment in which it is asked varies widely. At a national scale, authentication may take place at a bank counter, through a government portal, a smartphone or a feature phone, in a city or in a community several hours from the nearest service centre.
The requirements also vary with context. Opening a bank account remotely requires a different level of assurance than a field worker verifying a resident's identity before providing a welfare payment. A hospital retrieving a patient's medical history has different considerations than a government portal allowing a resident to change their address. In very few cases can connectivity or capability be assumed; in others, designing around that assumption could exclude precisely the people who need these services most.
There is therefore no universal set of circumstances in which authentication takes place. With this in mind, MOSIP developed two key components for authentication and eKYC:
Both these components help create trust in a person's identity, but are designed to address different aspects of an authentication journey. Countries and service providers can select which type of authentication method based not on just who needs to be authenticated, but on where, how, and for what purpose that authentication is taking place.
1. The ID Authentication Module (IDA)
IDA is MOSIP’s core authentication layer. It is a lightweight, REST-based API that connects relying parties and resident identity verification services.
With IDA, you can perform several types of authentication through a single API call:
With IDA, authentication can occur with either biometric data (i.e., fingerprints, irises, faces), or demographic information.
Architectural Features
RESTful endpoints using JSON or XML payloads
End-to-end encryption and digital signatures
Token-based per-request authorisation
Modular microservices design
Works independently on browser-based workflows
IDA is ideal in environments where there may be poor connectivity or limited bandwidth, when devices carry minimal user interfaces, when authentication takes place on a trusted device (such as a Point-of-Sale Terminal), or when access occurs via USSD or Feature Phones.
Some examples include:
eSignet builds on newer identity protocols such as OAuth 2.0 and OpenID Connect (OIDC), which enables the existing set of applications, libraries, and OpenID/OAuth ecosystem to plug and play into eSignet.
eSignet is an OpenID Connect provider designed for browser-based authentication. It manages resident verification, consent, and token issuance, making it particularly suited to internet-enabled services accessed through personal devices, browsers, or connected POS terminals. This offers services considerable flexibility, but also assumes reliable internet connectivity and access to a compatible device.
Architectural Characteristics
OIDC-compliant authorisation flows (Eg: Authorisation Code Flow)
Browser-based redirect and consent experience
Issues ID tokens and access tokens
Resident verification and consent management
Built for relying party integration
eSignet works best where connectivity is reliable, services are delivered through web or mobile applications, and multiple relying parties need a standard way to integrate authentication. Typical examples include online banking onboarding, e-governance and enterprise portals, and private-sector eKYC services.
Since eSignet is built on the widely adopted OIDC standard, integration is relatively straightforward. Standard OIDC libraries are available across most programming languages, allowing partners to use familiar tools rather than build custom API encryption and authentication layers from scratch.
MOSIP's design starts from a simple reality: no two countries, and often no two regions within the same country, operate the same way. A national identity system cannot assume a single kind of resident, device, or connection; and thus building a single authentication model is neither practical nor scalable across this range.
To address this, MOSIP focuses on a flexible, ecosystem-driven approach; complementary solutions, rather than one solution trying to do everything. IDA and eSignet are the clearest expressions of this.
IDA prioritises flexibility and performance in sparsely connected environments.
eSignet prioritises interoperability and standardised federation in connected ecosystems.
This thinking extends across MOSIP, where products are designed around the different devices, connectivity conditions, service environments, and ways in which people may need to use digital identity – rather than assuming a single digital journey will work for everyone.
Both eSignet and IDA are designed to be used separately and address authentication challenges based on various contexts. When combined, they create a far more complete and resilient authentication environment that maintains performance, interoperability, and adaptability under vastly differing real-world conditions.
With IDA
Integration with IDA provides strong flexibility and control, but typically involves deeper system-level implementation. This includes handling encryption and key management, defining request and response structures, configuring policies, and managing secure data exchange. As a result, it requires skilled IT teams and is best suited to environments where tighter trust relationships and customised integrations with relying parties are feasible.
With eSignet
eSignet, on the other hand, streamlines integration by adopting widely used standards like OIDC, allowing systems to leverage existing libraries and frameworks for faster onboarding. This reduces implementation complexity and accelerates partner integration. At the same time, it is designed for connected environments, where browser-based interactions and stable internet access are available.
Both IDA and eSignet are built to integrate with external systems, but they cater to different integration models. IDA enables highly customisable, tightly controlled integrations, while eSignet promotes standardised, interoperable integrations. Depending on the country's needs, they can be adopted independently or used together to balance flexibility with ease of integration.
