UAE PASS Integration: How Login Works and How to Onboard

UAE PASS integration means adding the UAE national digital identity as a login and verification option in your web or mobile app. A private company applies as a service provider with a valid UAE trade licence, builds on a staging environment, and passes an assessment before it goes live. This guide covers how the login flow works, the onboarding phases, which account levels to accept and the mistakes that slow teams down.

What does UAE PASS give your app?

It gives your app a way to confirm who a user is without you running your own ID checks. The UAE PASS FAQ lists what service providers can use: mobile authentication, digital signature (user signing and eSeal), signature verification and secure document sharing (marked "upcoming").

The data you get back depends on the user's account level. Mobile, email, a UUID and userType come back for every level. The Emirates ID number (idn) and Arabic names come back only for verified accounts, according to the attributes list.

Here is a hypothetical example. Say a Dubai trading company runs a customer portal where buyers apply for a credit account. A plain email signup tells the team nothing about who is behind it. A UAE PASS login with a verified account returns an Emirates ID number, so the sales team starts from a confirmed identity.

How does UAE PASS integration work step by step?

The login is a standard OAuth 2.0 authorization-code flow. These are the steps for a web app, based on the authorization guide:

1. Your app sends the user to the /idshub/authorize endpoint with your client ID, redirect URI, scope and a state value.
2. The user enters an identifier and confirms a push notification in the UAE PASS app on their phone.
3. UAE PASS sends the user back to your redirect URI with a code and your state.
4. Your server exchanges the code for a bearer access token (grant_type=authorization_code, with the redirect_uri and code).
5. Your server calls the user info endpoint with the Bearer token. This is a back-channel call, so the browser never sees it.
6. Your app matches the returned identity to an existing account or creates a new one.

On staging the host is stg-id.uaepass.ae, and the example uses the scope urn:uae:digitalid:profile:general. Production uses a different host. Take the exact production values from the onboarding team, not from a blog.

Two details catch people out. Visitors need extra scopes (profileType and unifiedId). Their user info response also carries unifiedID and profileType instead of the Emirates ID fields a citizen or resident gets.

This guide describes the web flow. Mobile apps use their own channel and credentials, so follow the mobile guide in the docs for that build.

What are the UAE PASS onboarding phases?

There are four phases: Initiation, Development, Assessment and Go live. The Development phase page lists them in that order.

The Initiation phase page lists the questionnaires by feature: Authentication, Digital Signature, e-Seal, Hash Signing and Data Sharing Authorization. You fill in only the ones for features you plan to use.

I could not check the full Assessment and Go-live pages for this post. Ask the onboarding team for the current checklist before you plan your launch date.

Which UAE PASS account levels should your app accept?

Accept SOP2 and SOP3 if your use case depends on a verified identity. The UAE PASS overview defines the levels:

The authentication scenarios guide says which levels are acceptable for each use case. Where every account in your database has verified attributes, only SOP2 and SOP3 are acceptable. Where you hold no verified attributes, SOP1 to SOP3 are all acceptable.

If you block SOP1, show the right message. The error message guidelines say SOP1 users must see a "not eligible, account not upgraded or visitor account" style message. Do not write your own wording.

What does UAE PASS integration cost, and how long does it take?

The UAE PASS FAQ states there are currently no charges for integrating. It also mentions a review in 2021, so the page is old. Confirm with the onboarding team before you rely on it.

The TDRA service Request for linking to UAE PASS gives initial approval to government and private entities. Private companies must provide a valid commercial licence. The fee is free. The steps are to log in with UAE PASS, fill in the application form and receive initial approval. The result is approval of technical linking.

An older TDRA page lists three working days for that initial approval. That covers the approval only. It is not the time for the whole project.

No official source gives a fixed total timeline. It depends on how fast you build, how clean your assessment is and how quickly the SPA is signed. Plan your launch around the onboarding team's confirmation, not a guess.

What mistakes slow UAE PASS integration down?

Most delays come from rules in the standard implementation guidelines. These are checked before use-case approval, at the staging assessment, right after go-live and in later quality checks. Watch for these:

• Mixing login flows. The UAE PASS login flow must be fully separate from your local login flow.
• Excluding user types. User types allowed through local login should also be allowed through UAE PASS.
• Using a production URL too early. To start on staging, the redirect URL must be a dev or stage URL. The production redirect URL is needed only after the assessment is signed off.
• Reusing credentials. Client credentials belong to one channel. Your website and your mobile app each need their own approval.
• Skipping the error scenarios. Your workflow and mockups should show what happens when login fails or the account level is too low.
• Collecting more than you need. Request only the attributes your use case needs, and check your duties under the UAE PDPL.
• Forgetting test users. For extra features such as facial biometric confirmation, the integration steps ask you to give an email, Emirates ID, name and mobile number for each test user. Prepare these early.

What should you have ready before you apply?

Use this short list before you open the Developer Portal request:

1. Your valid UAE trade licence and the emirate you are registered in.
2. A written use case, including which account levels you accept.
3. A workflow diagram of the user journey, with error paths.
4. UI mockups (wireframes) for the login screens.
5. Separate plans for web and mobile channels.
6. A dev or stage redirect URL.
7. Someone with authority to sign the SPA.

If you need a team to build the app side, Quickship builds mobile apps and custom software on quote. Quickship is a software company. It builds the integration, and your business remains the service provider applying to UAE PASS.