UAE PASS integration for websites and apps: login, onboarding steps and the rules you must follow

What UAE PASS offers a private company

The UAE PASS developer documentation describes UAE PASS as a national digital identity and digital signature platform, managed by Digital Dubai, the Telecommunications and Digital Government Regulatory Authority (TDRA) and the Abu Dhabi Digital Authority, that gives users one profile for services across the UAE. It lists three capabilities, and they are not all open to everyone:

• Authentication: Sign in with UAE PASS on a website or app. Available to government entities and private organisations.
• Digital signature and e-Seal: users sign documents with their UAE PASS identity, and an organisation can seal documents with its own e-Seal certificate. Available to government entities and private organisations.
• Data and document sharing: a user approves, in the UAE PASS app, the sharing of a document from one organisation to another, for example a salary certificate. Available to private organisations only; government entities use the Government Service Bus instead. The scope page limits it to documents, not individual attributes, and to users with a fully verified account.
• Facial biometric transaction confirmation: a face check before a sensitive action, such as a payment or a change of details. The documentation says it is integrated only on special approval, depending on the use case.

Account levels: what you can rely on

Every UAE PASS account has a Strength of Profile (SOP) level, and the level decides which data you receive and what the user can do. The user account types page defines three levels, and your use-case diagram must state which ones your service accepts. The attributes list shows that the Emirates ID number, Arabic names, nationality and gender come back only for SOP2 and SOP3 accounts, so a service that needs a verified identity must handle SOP1 users with a clear message rather than an error.

Visitors can also hold UAE PASS accounts, registered with a passport or GCC ID according to the UAE PASS FAQ. They never return an Emirates ID number, and the authorisation request needs extra scopes to receive the profile type and a unified ID, so decide at the start whether visitors may use your service.

The onboarding process, phase by phase

UAE PASS access is approved per use case, and the documentation splits onboarding into four phases. Budget for the approval steps as well as the development: the code for a login is small, while the questionnaires, diagrams, assessment and agreement take most of the calendar time.

How the login works technically

The web flow is the OAuth 2.0 authorisation code grant. The endpoints page lists separate authorisation, token, user info and logout URLs for staging (stg-id.uaepass.ae) and production (id.uaepass.ae). The authorisation request carries your client ID, redirect URI, scope, an acr_values authentication level, a state value that UAE PASS recommends for protection against cross-site request forgery, and ui_locales set to en or ar to show the login page in English or Arabic.

The user enters an email, mobile number or Emirates ID, approves a push notification in the UAE PASS app by matching a code, and is redirected back to you with an authorisation code. Your server, never the browser, posts that code to the token endpoint with HTTP Basic authentication of the client ID and secret, then calls the user info endpoint with the bearer token. The proof-of-concept guide says the code can be used once, and the FAQ says production access tokens last 3,600 seconds and the expiry is not configurable. Because the documentation gives different code lifetimes on different pages, exchange the code immediately.

When the user logs out of your site, the logout page requires you to end their UAE PASS session too, by redirecting to the UAE PASS logout endpoint. According to the FAQ the APIs are public and reachable from outside the UAE, so hosting outside the country does not block the integration.

Mobile apps: app-to-app login

In a mobile app, users expect to tap Sign in with UAE PASS and be sent to the UAE PASS app on the same phone, then straight back. The mobile requirements describe how: your app registers its own URI scheme, starts the OAuth flow in a WebView, intercepts the UAE PASS app link, rewrites its callback to your scheme, opens the UAE PASS app, and resumes the flow in the WebView when the user returns. If the UAE PASS app is not installed, login continues inside the WebView. UAE PASS publishes iOS and Android sample apps and warns integrators to use their own scheme, not the demo app's, to avoid sending users to another provider's app.

Client credentials are issued per channel, web or mobile, and may not be reused on another channel without UAE PASS approval, so a company with a website and an app plans both use cases in the same request. Store review for the app itself is covered in our guide to publishing on the App Store and Google Play.

Account linking and the rules the assessment checks

Most of the assessment is about what happens after the login: how you match a UAE PASS user to an existing customer account, and how you create a new one. The standard implementation guidelines and the user linking pages set the rules below, and the onboarding team checks them before approval, during the staging assessment and again after go-live.

• Keep the flows separate: Sign in with UAE PASS and Sign up with UAE PASS must never merge into your existing username-and-password login or registration.
• Store the UUID: every UAE PASS profile has a unique identifier, and you must store it on the linked account and use it to match the user on every later sign-in.
• Link on verified, unique attributes: automatic linking uses the UUID or a verified Emirates ID. Users can change their email and mobile in UAE PASS, so links built on those break and create duplicate accounts. Linking on a verified email alone is accepted only when nothing better exists.
• Do not mix verification levels: do not link a verified UAE PASS account to an unverified local account, or the reverse.
• Offer manual linking: a user whose existing account has no matching verified attribute signs in with their old credentials once, and you store the UUID.
• No passwords for UAE PASS users: a user who registers through UAE PASS must not be asked to create a username or password, and any backend password must not be sent to them. They can set one later through Forgot password on your normal login.
• Release all three scenarios together: automatic linking, manual linking and new registration go live in the same release, so no existing customer is stranded.
• Do not let users edit UAE PASS data: names, Emirates ID, email and mobile pulled from UAE PASS are read-only in your registration form and profile.
• Let the user start the login, follow the design guidelines for the button and error messages, and offer the same services through UAE PASS that you offer through your own login.

Company accounts, minors and other edge cases

UAE PASS identifies people, not companies. The FAQ says that deciding who may act for a company is the service provider's job after login: you keep the mapping of authorised individuals to company accounts and let the user choose whether to continue as themselves or as a company representative. The same applies to dependants such as minors and elderly relatives, where you maintain the authorisation for a representative and keep an offline route for people who cannot use the app.

On cost, the UAE PASS FAQ says there are currently no charges for integrating, although that answer refers to a review planned for 2021, so confirm the commercial terms in the Service Provider Agreement. Fixes for the errors integrators see most often, such as a callback URL mismatch, an invalid scope or an expired code, are collected on the common integration issues page.

Personal data and related UAE rules

Signing in with UAE PASS hands your system verified personal data, including Emirates ID numbers, so collect only the attributes the service needs, protect them as identity data and describe the processing in your privacy policy. If you also sell or invoice online in the UAE, read our guides to UAE VAT registration for online sellers, UAE e-invoicing and payment gateways in the UAE. For Saudi Arabia and Oman, the equivalent data rules are in Saudi PDPL compliance and Oman PDPL compliance.

How OGB Labs helps

We build UAE PASS login into websites, customer portals and iOS and Android apps for UAE companies. That covers the questionnaire, the use-case diagram and mock-ups the onboarding team reviews, the OAuth integration on staging and production, app-to-app login, the account-linking logic for existing customers, and the recorded assessment scenarios, alongside the rest of the product. See web development in the UAE, custom software and mobile apps, or message us on WhatsApp at +968 7111 0727.