Identity verification with national eID is a capability in ProVide Server that lets you require the recipient of a link to prove who they are – using a national eID such as Swedish BankID or FrejaID – before they can access anything. Only the specific individuals whose personal identification numbers you have approved will get in. Nobody else.
It works across all three of ProVide’s link types: Share (download and view), Receive (upload to you), and Collaborate (shared folder access).
How national eID verification works #
When you create a Share, Receive or Collaborate link, you can now choose Specific people and enter the personal identification numbers of the intended recipients – in Sweden, the personnummer.
When a recipient opens the link, ProVide redirects them to the configured identity provider. They authenticate with their national eID, and ProVide receives back a verified personal number. If it matches your approved list, access is granted. If it does not, the link stays closed.
The feature is built on the OpenID Connect (OIDC) standard and its ssn claim, which carries a person’s national identification number. Any OpenID Connect-compliant identity provider that returns such an identifier works with ProVide out of the box.
The problem it solves #
A link on its own is accessible to anyone who has the URL. Adding email-based access control is better, but email addresses can be forwarded, shared, or compromised. Neither approach gives you a genuine guarantee that the right person is on the other end.
Organizations handling sensitive, personal, or regulated content need something stronger: proof that the person opening the link is the individual it was meant for, not just someone who came by the URL. That proof comes from the same national eID infrastructure people already use for banking, healthcare, and government services.
BankID and FrejaID #
The first driver for this feature was a Swedish municipality that needed to distribute citizen documents to verified individuals. Sweden has very high digital identity adoption – BankID is used by roughly eight million people for everything from logging in to their bank to signing legal documents, and FrejaID is the government-backed alternative, which also covers some international use cases.
ProVide integrates with both. Public bodies, healthcare providers, and legal firms can share sensitive content with a specific citizen and be confident that only that named individual can open it – verified by infrastructure they already trust.
Common scenarios #
- Municipal and government services: case decisions, permits, and citizen correspondence delivered to the right person by personnummer.
- Healthcare: patient results, referrals, and care plans sent to the patient or a named practitioner.
- Legal and financial services: contracts, account statements, and confidential advice delivered to the verified client.
- HR and payroll: salary and employment documents that reach the right employee rather than a shared inbox.
Works beyond Sweden #
Although it was built with Sweden in mind, the feature rests on a global standard. The OIDC ssn claim is part of the international OpenID Connect specification, and national eID schemes across Europe and beyond are adopting it. Any organization running an OpenID Connect-compliant identity provider that returns a personal identifier in the ssn claim – or places it in the standard sub field – can use this immediately, with no product changes. As national eID adoption grows, ProVide can follow into new markets without further integration work.
Supported identity providers #
Any OpenID Connect provider that returns an ssn claim, or carries the personal identifier in the sub claim, is compatible. This includes:
- Swedish BankID (through BankID-compatible OIDC brokers)
- FrejaID (Swedish government eID, with some international coverage)
- Other Nordic and European national eID providers adopting OIDC
- Enterprise identity providers that carry a personnel or national ID number in the token
ProVide uses standard OIDC discovery to detect which claims a provider supports, and the admin interface shows exactly what will be used for verification before you issue a link.
Good to know #
- No recipient account needed. People authenticate with the eID they already have – no registration, no new password.
- Per-person revocation. You can remove one recipient’s access at any time without affecting anyone else on the same link. This matters in regulated settings.
- Audit trail. Every access attempt is logged with the verified identity of the person who authenticated – useful evidence for compliance, legal, and audit purposes.
- Standards-based. The feature uses OpenID Connect, the same standard behind Google, Microsoft, and every major European eID scheme, so it is ready for future providers.
