Significant engineering investment required
Typically several months of senior backend engineering time, plus ongoing maintenance. Every spec update from GovTech means another development cycle.
SingVMS uses Singapore's national authentication stack to verify every visitor. Here's how the Singpass integration works under the hood, what the protocols require, and why you don't need to build any of it.
Free plan: 50 check-ins/month · No GovTech onboarding required · REST API from Professional
SingVMS integrates with Singapore's National Digital Identity (NDI) system through the Singpass OIDC endpoints. This lets our visitor management system authenticate every visitor with government-verified identity instead of passwords or self-declared forms. The integration uses the FAPI 2.0 security profile — a stricter layer on top of standard OAuth 2.0 — requiring DPoP-bound tokens, PKCE S256, and Pushed Authorization Requests (PAR). All of this runs on our side. You get verified data through a dashboard or API.
SingVMS handles three stacked specifications so you don't have to. Understanding what each layer does explains why building Singpass integration yourself takes months.
| Layer | What it is | Key requirements | Specification |
|---|---|---|---|
| OIDC | OpenID Connect — the base authentication protocol. Provides the /authorize, /token, and /userinfo endpoints. ID tokens carry identity claims. | Discovery endpoint, ID token validation, nonce verification, JWKS key retrieval | OpenID Connect Core 1.0 |
| FAPI 2.0 | Financial-grade API Security Profile. The hardened layer GovTech mandates on top of OIDC. Prevents token theft, replay, and interception attacks. | PAR (RFC 9126), PKCE S256 (RFC 7636), DPoP sender-constrained tokens (RFC 9449), strict redirect URI matching | FAPI 2.0 Security Profile |
| NDI | National Digital Identity — Singapore's government framework. Singpass is the consumer-facing identity app within NDI. GovTech operates the infrastructure. | Relying party registration, security assessment, staging + production environment approval, ongoing compliance | GovTech NDI Technical Reference |
Singpass integration isn't a weekend project. FAPI 2.0 adds significant complexity on top of standard OIDC, and GovTech's onboarding process has its own timeline regardless of how fast you code.
Typically several months of senior backend engineering time, plus ongoing maintenance. Every spec update from GovTech means another development cycle.
You can build directly on GovTech's APIs or go through a registered provider. Here's what each path looks like.
Visitor management system with built-in Singpass integration. FAPI 2.0 handled for you. REST API + webhooks for custom integrations on Professional and above. Free plan: 50 check-ins/month.
GovTech's own API for retrieving consented personal data. Free to use, but you handle the full FAPI 2.0 implementation, relying party registration, and security assessment yourself.
Various system integrators offer Singpass integration as part of larger enterprise projects. Typically custom-scoped engagements with longer timelines and higher costs.
Full control, full responsibility. You'll implement FAPI 2.0, manage key rotation, pass GovTech's security review, and maintain compliance. Best for teams with specific requirements that providers can't meet.
If you're evaluating build vs. buy, these are the four protocol components you'll need to implement and maintain.
FAPI 2.0 doesn't allow front-channel authorization requests. Instead, you POST your auth parameters to the PAR endpoint first, receive a request_uri, then redirect the user with only that URI. This prevents request tampering and parameter injection. Defined in RFC 9126.
Proof Key for Code Exchange prevents authorization code interception. You generate a random code_verifier, hash it with SHA-256 to create the code_challenge, send the challenge at auth time, and present the verifier at token exchange. Only S256 is accepted — plain is not allowed. RFC 7636.
Demonstration of Proof-of-Possession binds each access token to a specific cryptographic key pair. Every API request includes a DPoP proof JWT signed with your private key. If a token is stolen, it's useless without the key. This is the mechanism that makes FAPI 2.0 tokens non-transferable. RFC 9449.
You host your public keys at a /.well-known/jwks.json endpoint. GovTech's servers fetch these to verify your DPoP proofs and client assertions. Keys must be rotated regularly. If your JWKS endpoint goes down or serves stale keys, authentication breaks for all your users.
SingVMS is an operational Singpass relying party. The FAPI 2.0 flow runs on our infrastructure. You get a visitor management dashboard with verified identity data.
Sign up at app.singvms.sg. You'll get a dashboard, your Singpass QR code, and API credentials in minutes. No GovTech onboarding needed.
Use the hosted QR code flow for visitor check-in, or call our REST API to embed Singpass auth in your own app. Webhooks fire on every authentication event.
Each Singpass authentication returns government-verified data: NRIC (masked), name, and any consented MyInfo fields. No FAPI 2.0 code on your side.
The technical details that matter when you're evaluating a Singpass integration path.
PAR, PKCE S256, DPoP, JWKS — all implemented and maintained. When GovTech updates the spec, we update the implementation. You don't touch crypto code.
We're an active Singpass relying party. Our registration, security assessment, and production approval are already done. You operate under our credentials.
GovTech's security assessment applies to the relying party — that's us. You skip the 4–8 week review process entirely. Go live in hours, not quarters.
On Professional and above: trigger Singpass auth via API, receive identity data via webhook callbacks. Standard REST patterns — no proprietary SDK required.
Get started with 50 check-ins per month on the free plan. Need more? Enterprise plans offer custom pricing — WhatsApp us to discuss.
NRIC is stored as a masked hash (S****567A + SHA-256), never in full. MyInfo data is fetched with user consent and processed per PDPA requirements. Audit logs track every access.
Standard OAuth 2.0 uses bearer tokens — anyone with the token can use it. FAPI 2.0 adds sender-constrained tokens via DPoP (RFC 9449), which bind each token to a cryptographic key pair. It also mandates PKCE with S256 (not plain), Pushed Authorization Requests instead of front-channel auth, and strict redirect URI validation. The practical difference: you're writing significantly more crypto code, and every token request requires a fresh DPoP proof JWT.
Only if you're connecting directly to GovTech's OIDC endpoints. If you use a registered provider like SingVMS, you operate under their existing relying party registration. This skips the application process, security assessment, and the 4–8 week onboarding timeline. For most businesses, going through a provider is faster and cheaper than registering independently.
The base Singpass Login scopes include openid, uinfin (NRIC/FIN), name, dob, mobileno, and email. Extended MyInfo scopes — address, employment, CPF, education — require separate MyInfo API onboarding and explicit user consent during the auth flow.
Plan for 4 to 8 weeks after your code is ready. The process includes submitting your application, passing the security assessment, testing in GovTech's staging environment, and receiving production approval. Delays are common if your FAPI 2.0 implementation has issues during the security review. Using a registered provider eliminates this timeline entirely.
NDI (National Digital Identity) is Singapore's national framework for digital identity, managed by GovTech under the Smart Nation initiative. Singpass is the consumer-facing application within NDI — it's how citizens and residents actually authenticate. When you "integrate with Singpass," you're technically connecting to NDI infrastructure through Singpass's OIDC/FAPI 2.0 endpoints. MyInfo, which provides consented personal data, is another service within the NDI ecosystem.
Singpass covers Singapore citizens, permanent residents, and some work pass holders who have been issued a Singpass account. Foreign visitors or short-term pass holders typically don't have Singpass. Most implementations include a fallback — a manual registration form or alternative ID verification — for users without Singpass access.
At minimum: Pushed Authorization Requests (PAR) via RFC 9126, PKCE with S256 challenge method per RFC 7636, DPoP proof tokens per RFC 9449 that bind access tokens to your key pair, a hosted JWKS endpoint for public key distribution, and sender-constrained token validation on every API call. You also need to handle key rotation, nonce management, and clock-skew tolerance. It's a significant step up from a standard OAuth 2.0 client.
SingVMS handles FAPI 2.0, GovTech registration, and key management. You get verified visitor records through a dashboard or API. Free plan: 50 check-ins/month.