Mobile-ID · Digital Trust
ISO/IEC 27001 · FIDO2 · OpenID — View scope
Mobile-ID SignGoPaperless Digital Signing
VIGet Started
INTEGRATION

GoPaperless SSO and VNeID sign-in

Use an SSO layer to connect sign-in to business applications; information sharing and signing authorization are separate decisions.

Explore platformDeveloper Center
ON THIS PAGE

Separate sign-in sessions, consent and signing authority

The GoPaperless SSO role below is an integration recommendation requiring agreed configuration. Mobile-ID publishes RAR cooperation for VNeID SSO/ShareInfo; the GoPaperless SSO name does not inherit every capability or certification of another product.

Sign-in, sharing and signing
ComponentRole and limits
GoPaperless SSORecommended ecosystem sign-in/session layer; actual capabilities follow the deployment contract.
VNeIDAuthentication source in the configured route; results must bind to the correct request and session.
ShareInfoAttributes shared for a purpose with consent; sign-in does not automatically release additional information.
CA / Trusted SICAuthorization for specific signing content; SAD and certificates are not SSO sessions.
Published SSO/ShareInfo source
EVIDENCE REGISTER

Evidence & publication scope

PUBLICLY DOCUMENTED

VNeID SSO / RAR cooperation

Mobile-ID public company timeline · 10/02/2026

Cooperation/service scope as publicly documented; SSO is presented as the authentication/session layer.

REFERENCE

Signing boundary

Identity ≠ Digital signature

Successful login does not itself create a digital signature.

REFERENCE

Consent & session

Implementation dependent

Exact claim/scopes/attributes depend on approved service contracts.

IDENTITY BOUNDARY

SSO establishes a session; it does not create a signature

SSO requires success/cancel/timeout/denied/error handling plus callback/session management. Digital signing begins only when the business transaction requests it and the user authorizes through the applicable signing route.

REFERENCE

Sequence linking identity, attributes and signing

  1. 01
    Enterprise application

    Persist the business reference and request state; prepare the approved redirect.

  2. 02
    Mobile-ID

    Orchestrate the request and maintain separate correlation for authentication, attribute sharing and signing.

  3. 03
    RAR/C06 / VNeID

    Authenticate through the applicable service; the user grants or denies consent.

  4. 04
    ShareInfo / callback

    Receive authorized attributes and validate the state against the initiated request.

  5. 05
    User / RS-HUB

    Request separate signing authorization on the applicable route; login is not consent to sign.

  6. 06
    CA / RSSP

    Create the signature within provider scope and return it for validation and reconciliation.

REFERENCE

Exception lane and recovery responsibility

If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.

Exception lane and recovery responsibility
OutcomeApplication / operator action
Cancel or denyReturn the user outcome; do not initiate signing.
Timeout or expired challengeReconcile first; create a new request only with renewed user confirmation.
Callback state mismatchReject and investigate correlation, session and redirect binding.
Attribute unavailable or deniedApply business policy; never substitute inferred identity data.
Signing provider unavailablePreserve the uncertain state; reconcile or escalate without silently switching routes.
REFERENCE

Responsibility boundaries and evidence

If the table is wider than its frame, scroll horizontally to see all columns; use arrow keys when the table region has focus.

Responsibility boundaries and evidence
ComponentResponsibilityEvidence to review
EnterpriseBusiness record, representative authority and acceptanceRecord reference, version and approval
Mobile-IDContract-scoped orchestration, correlation and handoffRequest, callback, state and audit
RAR/C06 / VNeIDApplicable identity / attribute serviceAuthentication result and consent scope
CA / RSSPSigning credential and signature creationCertificate, signed output and verification
RELATED

Related content

Choose the next document for your task.

Your first signing transactionWalk through a synthetic transaction and understand why request acceptance is not signing completion.Signing transaction modelLink the document, signer, purpose and route to the source business record.Webhooks and state reconciliationReceive events safely, handle duplicates and ordering, and reconcile against the transaction state source.Errors, retry and recoveryDistinguish input, access, conflict and provider failures before deciding whether to retry.
NEXT STEPDiscuss deployment requirements

From session to authorized action

  1. 01

    Start on the backend

    Bind the request to the session and organization. Confirm endpoints, protocol, attributes and callbacks before enabling live sign-in.

  2. 02

    Receive authentication result

    Validate source, validity and account linkage under the contract; never merge accounts by display name alone.

  3. 03

    Request sharing separately

    Specify attributes, purpose and consent. Keep sharing outcomes separate from signing authority and transaction state.

  4. 04

    Authorize signing separately

    The user reviews content and confirms through the CA/SIC route; successful sign-in does not replace this step.

Token boundaries and session recovery

Token categories
TypeUsage
ID token / access tokenIdentity or access authority if provided by the deployment protocol; agree issuer, audience and lifecycle under the contract.
Viewer / file / signing tokenGateway document objects/sessions; not substitutes for sign-in credentials.
SADSIC authorization/activation data; not an SSO session.

When a session expires, stop new actions and reauthenticate under configuration. For submitted signing requests, retain references and reconcile before resubmission. Logout, revocation and account linkage must be agreed in deployment documentation.

Search Mobile-ID Sign

Local search inside the offline package.