Standard REST endpoints for Singpass-verified visitor check-in. Generate QR codes, poll status, get government-verified identity data. The Singpass FAPI 2.0 complexity is handled on our side.
Free plan: 50 check-ins/month · Sandbox included · No GovTech paperwork
The SingVMS Visitor Management API lets you embed Singpass-verified check-in into your own applications. It abstracts Singapore's FAPI 2.0 and OIDC protocols into standard REST endpoints you can call with an API key. Generate a QR code, poll for authentication status, and receive government-verified visitor identity — all without touching Singpass's security profile directly.
You can implement FAPI 2.0 and build visitor management from scratch, or call our REST endpoints and get verified identity data back.
Three endpoints, two webhook events, six data scopes. That's the entire surface area.
No GovTech review. No security assessment. SingVMS is already a registered relying party.
Sign up for a free account. Generate sandbox API keys from the dashboard. Takes about 30 seconds.
Call the endpoints with sandbox keys. Generate QR codes, poll status, get test identity data. Uses Singpass staging environment.
Switch to production keys. Same endpoints, same response format, real Singpass authentication. No additional review needed.
Request only the data you need. Each scope maps to a verified field from Singapore's MyInfo database.
Base scope required for all requests. Confirms the user authenticated via Singpass. Returns a session token.
Returns a masked NRIC (S****567A) and a SHA-256 hash. Full NRIC is never stored or exposed. Use the hash to match returning visitors.
The user's registered name as it appears on their NRIC. Government-verified, not self-reported. Returned as an uppercase string.
ISO 8601 format (YYYY-MM-DD). Useful for age verification, access control rules, or compliance requirements.
The mobile number registered to the user's Singpass account. Formatted with country code (+65). Useful for follow-up communications.
The email address linked to the user's MyInfo profile. Not all users have this populated. Handle null values in your integration.
Every piece of Singpass complexity we've abstracted away from your integration.
The Financial-grade API security profile is implemented and maintained on our side. You never touch OIDC discovery, token endpoints, or compliance profiles.
Demonstration of Proof-of-Possession and Proof Key for Code Exchange run server-side. Your integration uses a simple API key. No cryptographic operations needed.
JSON in, JSON out. No proprietary SDKs, no SOAP, no XML. Works with any language or framework that can make HTTP requests.
Get notified when events happen instead of polling. Configure webhook URLs in the dashboard and receive signed POST requests for check-in and identity events.
NRICs are masked and hashed, not stored in full. Data retention follows PDPA guidelines. You get verified identity without the compliance burden of holding raw PII.
50 check-ins per month on the free plan. No credit card to start. Need more? Enterprise plans with custom pricing are available — WhatsApp us.
What developers usually ask before starting.
API key authentication via the X-API-Key header. Keys are scoped per environment (sandbox and production) and can be rotated from your dashboard at any time. All requests must be made over HTTPS.
Yes. The API gives you the building blocks: QR code generation, status polling, and identity retrieval. You can embed these in any frontend you want, whether that's a kiosk app, a mobile check-in flow, a web portal, or a Singpass visitor management system. The UX is yours to design.
100 requests per second per API key. API access starts on the Professional plan. For higher volume, WhatsApp us for custom enterprise pricing.
No. SingVMS is already registered as a Singpass relying party with GovTech. Your authentication requests go through our registered integration. You skip the GovTech onboarding process, security assessment, and ongoing compliance maintenance entirely.
The session status endpoint will show a timeout if no one authenticates. You can detect this and fall back to a manual registration form. In practice, most Singapore citizens and PRs (4M+ users) already have Singpass, so this is an edge case rather than the norm.
Set a webhook URL in your dashboard. When events fire (like checkin.completed or identity.verified), we send a POST request with a JSON payload to your URL. Each request includes an X-Webhook-Signature header with an HMAC-SHA256 signature so you can verify it came from us.
Full NRICs are never stored or returned. You get a masked version (S****567A) for display and a SHA-256 hash for matching returning visitors. This approach satisfies PDPA requirements while still giving you a stable identifier for repeat check-ins.
Yes. The sandbox environment connects to Singpass staging, which provides test NRICs and mock authentication flows. You can run the full integration cycle without real user data. When you're ready, switch to production keys and everything works the same way against real Singpass.
Free tier. Sandbox included. No GovTech paperwork.
Free plan: 50 check-ins/month. Enterprise: custom pricing.