Back channel, server to server
Front channel, redirect through the browser
Work inside one component
How a sign-in or a credential moves between the citizen, the identity providers, the identity exchange and the agencies, one hop at a time. Pick a flow and press play, or step through it.
Each party holds a different identifier for the same person. Only the exchange can map between a provider's identifier and an agency's, and it keeps no name or email to do anything else with them.
| Identifier | Example | Held by | Scope | Can it link the citizen across services? |
|---|
Identifier values are illustrative, shaped like those in the live demo. Agency A and Agency C receive pairwise subjects derived by the exchange from the agency's host and a secret salt. Atlantis ID sends the exchange its own per-application pairwise claim, because Auth0 can't change its global sub.