Issuer enables the flow
A supported identity provider issues credentials with provenance OTRUST can verify.
Partner Auth preview
Hemsted-branded OTRUST Auth preview.
The challenge and callback integration can be reviewed here. Trusted identity credential issuance is not currently available.
Planned hosted flow
Hemsted integration, with issuer binding.
The planned flow presents a credential-verification screen tied to a short-lived challenge. Production challenge creation remains disabled until a trusted issuer is configured.
Challenge starts at Hemsted
Hemsted creates a short-lived challenge and sends the user to otrust.eu.
Credential and callback verified
OTRUST verifies issuer binding before returning a signed token and preserved state.
Production controls
Theme configuration for Hemsted's hosted Auth flow.
The hosted theme controls brand presentation only. It does not change challenge creation, callback handling, token verification, or registered redirect behavior.
Visual branding
- Logo
- SVG/PNG URL, max 240x60px, 200KB asset cap
- Background
- Hex, rgb, or rgba with OTRUST fallback
- Primary color
- Buttons and key highlights
- Text color
- Defaults to
#0F1B2D - Font
- Approved HTTPS self-hosted URL or system font stack
- Radius / spacing
- 4-12px radius, tight/default/loose spacing
Copy
- Headline
- Sign in to Hemsted
- Subhead
- Issuer-bound credential required
- Footer
- © Hemsted AB · OTRUST Auth preview
- Info blurb
- Short explanation of the issuer and
otrust.euboundary - Disclosure
- OTRUST remains visible as the credential-processing layer
Behavior
- Verification method
- Issuer-bound credential, pending
- Auto-return
- Minimum success-delay before callback redirect
- Challenge scope
- Identity scope activates only after issuer integration
- Callback
- Registered redirect URL and state are preserved unchanged
Trust guarantees
OTRUST remains visible throughout processing.
The preview keeps future processing ownership clear while allowing Hemsted-approved branding.
Users must know who processes the hosted flow.
The issuer and OTRUST processing boundary must be visible.
The screen remains a preview until a trusted credential issuer is active.
The browser stays on otrust.eu. That is a feature, not a bug.
OTRUST GDPR/DPO links remain visible for processing questions.
Planned flow
Challenge-bound verification after issuer integration.
The challenge and callback contract is implemented for integration testing. Production returns trusted_identity_issuer_required until credential provenance is available.
Partner creates challenge
After issuer enablement, Hemsted receives a hosted login URL tied to a short-lived challenge.
User verifies credential
The hosted branding and callback flow is a preview until a trusted credential issuer integration is enabled.
Callback returns to Hemsted
The callback remains registered, scoped, and state-bound. Partner branding does not change auth semantics.
Integration
Review the hosted OTRUST Auth contract.
Open API reference
Integrate only after health reports a trusted issuer; then verify callback token, audience, state, and expiry server-side.