QoreID¶

QoreID is the default provider. Configure its server-side client ID and secret in the application environment; the package exchanges credentials for an API bearer token internally.

IDENTITY_MADE_EASY_PROVIDER=qoreid
QOREID_CLIENT_ID=your_qoreid_client_id
QOREID_SECRET=your_qoreid_secret
QOREID_BASE_URL=https://api.qoreid.com
QOREID_HTTP_TIMEOUT=30

The API bearer token used for server-to-server collection operations is not the same as the short-lived Web/Mobile SDK session token. Never expose the client secret, API token, or session token as a frontend build-time value.

Use capability interfaces¶

The driver implements optional interfaces. Check support before invoking a capability:

use Alphabalex\IdentityMadeEasy\Contracts\DigitalIdentityDriverInterface;
use Alphabalex\IdentityMadeEasy\Facades\Identity;

$qoreid = Identity::driver('qoreid');

if ($qoreid instanceof DigitalIdentityDriverInterface) {
    $result = $qoreid->verifyNin('12345678901');
}

All named QoreID operations use fixed HTTP methods and routes, exchange/cache the backend API token, and return the decoded provider response. There is no public arbitrary-path request method.

SDK sessions¶

Mint a session on your backend, then return only the short-lived session token and any required metadata to your client:

use Alphabalex\IdentityMadeEasy\Contracts\IdentitySessionDriverInterface;
use Alphabalex\IdentityMadeEasy\Facades\Identity;

$qoreid = Identity::driver('qoreid');
if ($qoreid instanceof IdentitySessionDriverInterface) {
    $session = $qoreid->createSession([
        'type' => 'workflow',
        'workflowId' => 123,
        'reference' => 'onboarding-456',
    ]);
}

Workflow sessions use HTTP Basic authentication with the client ID and secret. Collection sessions use a product code enabled for your account:

$session = $qoreid->createSession([
    'productCode' => 'nin',
    'reference' => 'onboarding-789',
    'subjectRef' => 'internal-user-42', // optional pseudonymous ID; do not put PII here
    'ttlSeconds' => 120,
    'maxAttempts' => 3,
]);

Provide exactly one of productCode or a positive integer workflowId, and a non-empty reference. See QoreID's product-code list, authentication reference, and session-token reference. A session token is short-lived and single-use; do not send it as a Bearer token for server API operations.

Supported operation families¶

The operation names below are methods on the corresponding optional interface. Detailed signatures are listed in the capability reference.

Capability interface	Operation family
`DigitalIdentityDriverInterface`	BVN, NIN, virtual NIN, LASRRA, voter, Nigerian passport, Ghana Card, Kenya ID/passport/alien card, driver's license
`BiometricVerificationDriverInterface`	Face checks for NIN, BVN, driver's license, virtual NIN, Nigerian passport, and Kenya passport
`BusinessVerificationDriverInterface`	CAC Basic, CAC Premium variants, TIN
`BankAccountVerificationDriverInterface`	BVN/NUBAN verification, NUBAN verification, BVN consent accounts, BVN-data bank list
`AddressVerificationDriverInterface`	Pro address verification
`BackgroundVerificationDriverInterface`	Guarantor verification and lookup
`AssetVerificationDriverInterface`	Property, vehicle, and license-plate verification
`EmploymentVerificationDriverInterface`	Employment verification submission
`WorkflowDriverInterface`	Workflow lookup and workflow/collection reports
`CollectionWebhookDriverInterface`	Resend collection webhooks
`IdentityLookupDriverInterface`	Country list
`IdentitySessionDriverInterface`	SDK session creation

The package implements the verified named operations in these interfaces; it does not claim to cover every QoreID endpoint. In particular, some operation topics are excluded where the available public route documentation is ambiguous or incomplete. Consult coverage notes before assuming an undocumented route exists.

Response handling and privacy¶

QoreID methods return decoded provider responses unchanged. HTTP failures and transport errors propagate to the caller; catch them at an application boundary and apply an appropriate retry/reporting policy. Invalid SDK session input fails before network access.

Verification results contain sensitive identity information. Obtain consent or another lawful basis, avoid logging full request/response payloads, minimize retention, and follow applicable privacy requirements. See webhooks and privacy.