singpass

Oct 1, 2026

Changes in this version

type Dependencies

+ AllowedPrivateHosts []string

type KeyManager

+ func NewKeyManagerWithDPoP(sig crypto.Signer, sigKID string, dpop crypto.Signer, ...) (KeyManager, error)

type LoginOptions

+ DPoPKey crypto.Signer

type MyinfoBusinessOptions

+ DPoPKey crypto.Signer

type MyinfoOptions

+ DPoPKey crypto.Signer

Sep 29, 2026

Changes in this version

type Client

+ func (c *Client) BeginLoginWith(ctx context.Context, lc LoginContext) (redirectURL string, state string, err error)

+ type LoginContext struct

+ Message string

+ Type string

type LoginOptions

+ AppClaimedHTTPS bool

+ AppLaunchURL string

+ AuthContextMessage string

type MyinfoOptions

+ AppClaimedHTTPS bool

+ AppLaunchURL string

type Options

+ AppClaimedHTTPS bool

+ AppLaunchURL string

+ AuthContextMessage string

Sep 27, 2026

Changes in this version

+ func ErrorCode(err error) string

+ func IsTemporary(err error) bool

type Dependencies

+ BeginLoginRetries int

+ KeyCustody KeyCustody

+ type KeyCustody = keys.KeyCustody

+ type ServerErrorResponse = client.ServerErrorResponse

+ func ServerError(err error) (ServerErrorResponse, bool)

Sep 27, 2026

Changes in this version

+ func CheckPublishedJWKS(ctx context.Context, hc *http.Client, jwksURL string, want []byte) error

+ func OfflineJWKS(ctx context.Context, signing, encryption []PublishedKey) ([]byte, error)

type Client

+ func (c *Client) CheckPublishedJWKS(ctx context.Context, jwksURL string) error

type Decrypter

+ func NewRotatingDecrypter(ctx context.Context, current ECDHAgreer, others ...DecryptionKey) (Decrypter, error)

+ type DecryptionKey struct

+ Agreer ECDHAgreer

+ DecryptOnly bool

+ KID string

+ Key *ecdsa.PrivateKey

type KeyManager

+ func NewRotatingKeyManager(sig crypto.Signer, sigKID string, published ...PublishedKey) (KeyManager, error)

type LoginOptions

+ AdditionalEncryptionKeys []DecryptionKey

+ AdditionalSigningKeys []PublishedKey

type MyinfoBusinessOptions

+ AdditionalEncryptionKeys []DecryptionKey

+ AdditionalSigningKeys []PublishedKey

type MyinfoOptions

+ AdditionalEncryptionKeys []DecryptionKey

+ AdditionalSigningKeys []PublishedKey

+ type PublishedKey struct

+ KID string

+ Key *ecdsa.PublicKey

Sep 27, 2026

Changes in this version

+ type SubjectAttributes struct

+ AccountType string

+ Email string

+ EntityCOI string

+ EntityName string

+ EntityRegNumber string

+ EntityType string

+ EntityUENStatus string

+ IdentityCOI string

+ IdentityNumber string

+ MobileNo string

+ Name string

+ Raw map[string]any

+ func (a SubjectAttributes) Present() bool

Sep 26, 2026

Changes in this version

type MyinfoBusinessOptions

+ TolerateUserInfoSubjectClientID bool

Sep 26, 2026

Changes in this version

type ActingParty

+ Attributes map[string]any

Sep 26, 2026

Changes in this version

+ const ProductionCorppassIssuer

+ const ProductionSingpassIssuer

type Dependencies

+ AllowLoopbackHTTP bool

+ type Environment int

+ const Production

+ const Staging

+ func (e Environment) String() string

type LoginOptions

+ Environment Environment

type MyinfoBusinessOptions

+ Environment Environment

type MyinfoOptions

+ Environment Environment

Sep 25, 2026

Changes in this version

+ const AssuranceDevelopment

+ const AssuranceProduction

+ var ErrLoginExpired = errors.New("singpass: login expired or already used")

+ type Algorithms = client.Algorithms

+ type AssuranceLevel = client.AssuranceLevel

+ type Clock = client.Clock

+ type Decrypter = keys.Decrypter

+ type ECDHAgreer = keys.ECDHAgreer

+ type KeyManager = keys.KeyManager

+ type Limits = client.Limits

+ type SessionStore = storage.SessionStore

+ type StoreAssurance = storage.StoreAssurance

Sep 25, 2026

Changes in this version

+ const DefaultAuthContextType

+ const DefaultMaxPendingLogins

+ const StagingCorppassIssuer

+ const StagingSingpassIssuer

+ var ErrTooManyPendingLogins = errors.New("singpass: too many pending logins")

+ func NewAgreerDecrypter(agreer keys.ECDHAgreer) (keys.Decrypter, error)

+ func NewECDHDecrypter(encKey *ecdsa.PrivateKey, encKID string) (keys.Decrypter, error)

+ func NewKeyManager(sig crypto.Signer, sigKID string) (keys.KeyManager, error)

+ func NewMemorySessionStore(maxPending int) storage.SessionStore

+ func OfflineClientJWKS(ctx context.Context, sigKey *ecdsa.PrivateKey, sigKID string, ...) ([]byte, error)

+ func RecommendedLimits(httpTimeout time.Duration) client.Limits

+ type ActingParty struct

+ Subject string

+ SubjectType string

+ type Client struct

+ func New(ctx context.Context, opts Options, deps Dependencies) (*Client, error)

+ func NewLogin(ctx context.Context, o LoginOptions, deps Dependencies) (*Client, error)

+ func NewMyinfo(ctx context.Context, o MyinfoOptions, deps Dependencies) (*Client, error)

+ func NewMyinfoBusiness(ctx context.Context, o MyinfoBusinessOptions, deps Dependencies) (*Client, error)

+ func (c *Client) BeginLogin(ctx context.Context) (redirectURL string, state string, err error)

+ func (c *Client) Complete(ctx context.Context, rawQuery string) (*Identity, error)

+ func (c *Client) PublicJWKS(ctx context.Context) ([]byte, error)

+ type DeniedError struct

+ Code string

+ Description string

+ func (e *DeniedError) Error() string

+ type Dependencies struct

+ Algorithms *client.Algorithms

+ Assurance client.AssuranceLevel

+ Clock client.Clock

+ Debug bool

+ Decryption keys.Decrypter

+ HTTPClient *http.Client

+ HTTPTimeout time.Duration

+ Keys keys.KeyManager

+ Limits *client.Limits

+ Logger *slog.Logger

+ Random io.Reader

+ Sessions storage.SessionStore

+ type Identity struct

+ App string

+ Claims map[string]any

+ IDTokenExpiry time.Time

+ IDTokenIssuedAt time.Time

+ Myinfo *myinfo.Response

+ Scope string

+ Subject string

+ func (id *Identity) ActingParty() *ActingParty

+ func (id *Identity) AssuranceContext() string

+ func (id *Identity) AssuranceLevel() string

+ func (id *Identity) Audience() []string

+ func (id *Identity) AuthMethods() []string

+ func (id *Identity) Issuer() string

+ func (id *Identity) SubjectAttributes() map[string]any

+ func (id *Identity) SubjectType() string

+ type LoginOptions struct

+ AcrValues string

+ AuthContextType string

+ ClientID string

+ EncryptionAgreer keys.ECDHAgreer

+ EncryptionKID string

+ EncryptionKey *ecdsa.PrivateKey

+ Issuer string

+ Name string

+ RedirectURI string

+ Scopes []string

+ SigningKID string

+ SigningKey crypto.Signer

+ type MyinfoBusinessOptions struct

+ AcrValues string

+ ClientID string

+ EncryptionAgreer keys.ECDHAgreer

+ EncryptionKID string

+ EncryptionKey *ecdsa.PrivateKey

+ Issuer string

+ Name string

+ RedirectURI string

+ Scopes []string

+ SigningKID string

+ SigningKey crypto.Signer

+ type MyinfoOptions struct

+ AcrValues string

+ ClientID string

+ EncryptionAgreer keys.ECDHAgreer

+ EncryptionKID string

+ EncryptionKey *ecdsa.PrivateKey

+ Issuer string

+ Name string

+ RedirectURI string

+ Scopes []string

+ SigningKID string

+ SigningKey crypto.Signer

+ type Options struct

+ AcrValues string

+ AuthContextType string

+ ClientID string

+ FetchUserInfo bool

+ Issuer string

+ Name string

+ RedirectURI string

+ Scopes []string

+ TolerateUserInfoSubjectClientID bool