FranceConnect API

Name: FranceConnect API API
Brand: FranceConnect API
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationbearer7 EndpointsREST

For Agents

Authenticate French citizens via OpenID Connect against FranceConnect and exchange the resulting code for an ID token plus verified identity claims. Bearer-token authorisation on the userinfo endpoint.

Connect the FranceConnect API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the FranceConnect API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with FranceConnect API API.

Redirect users to /authorize to start an OpenID Connect login against FranceConnect identity providers

Exchange an authorisation code for an ID token and access token at /token

Fetch verified identity claims (given_name, family_name, birthdate, birthplace, gender, email) from /userinfo

Discover endpoint URLs and supported scopes via /.well-known/openid-configuration

GET STARTED

Start building with FranceConnect API API

Explore with Jentic

View OpenAPI Document

FranceConnect is the French government's identity federation service that lets citizens sign in to public and private service providers using credentials they already hold (impots.gouv.fr, ameli, La Poste, MSA). The API implements OpenID Connect with seven endpoints covering discovery, authorisation, token exchange, user info, JWKS, and session termination. Service providers integrate against version 2 to authenticate users and receive verified identity claims (given name, family name, birthdate, birthplace, gender, email).

Use Cases

Patterns agents use FranceConnect API API for, with concrete tasks.

★ Public Service Login Federation

A French e-government service redirects users to FranceConnect, lets them choose any approved identity provider, and receives back a signed ID token plus verified civil-status claims. The integration replaces a custom login flow with a state-recognised identity check that satisfies eIDAS substantial assurance.

Build the /authorize redirect URL with client_id, redirect_uri, scope=openid profile email, then exchange the returned code at /token for an id_token

Private-Sector KYC Onboarding

A French bank or insurer uses FranceConnect to verify a new customer's civil status without asking them to upload ID documents. After the user authenticates, /userinfo returns government-validated given name, family name, and birthdate that can be persisted to the customer record. This shortens onboarding from days to minutes.

Call GET /userinfo with the bearer access_token returned from /token and persist the given_name, family_name, birthdate, and birthplace claims to the customer record

Single Sign-Out Across Government Sites

When a user logs out of one FranceConnect-federated service, the session must end across all other FranceConnect sessions. Calling /session/end with the id_token_hint terminates the federated session and notifies other relying parties, which is mandatory for compliance with the FranceConnect technical specification.

Redirect the user to /session/end?id_token_hint={id_token}&post_logout_redirect_uri={return_url} to terminate the FranceConnect session

AI Agent Identity Verification

An agent acting on behalf of a French citizen uses FranceConnect through Jentic to obtain verified civil-status claims, then calls a downstream administrative API on the user's behalf. Jentic isolates the client_secret in the vault and returns only the resolved identity claims to the agent's context.

Search Jentic for 'authenticate a French user via FranceConnect', execute the /authorize and /token flow, and return the verified userinfo claims

Key Endpoints

7 endpoints — franceconnect is the french government's identity federation service that lets citizens sign in to public and private service providers using credentials they already hold (impots.

METHOD

PATH

DESCRIPTION

GET

/.well-known/openid-configuration

Read the OpenID Connect discovery document

GET

/authorize

Start the OpenID Connect authorisation flow

POST

/token

Exchange an authorisation code for an ID token

GET

/userinfo

Fetch verified identity claims for the authenticated user

GET

/jwks

Retrieve the JSON Web Key Set for ID token validation

GET

/session/end

Terminate the FranceConnect session

GET

/.well-known/openid-configuration

Read the OpenID Connect discovery document

GET

/authorize

Start the OpenID Connect authorisation flow

POST

/token

Exchange an authorisation code for an ID token

GET

/userinfo

Fetch verified identity claims for the authenticated user

GET

/jwks

Retrieve the JSON Web Key Set for ID token validation

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

FranceConnect client_id and client_secret are stored encrypted in the Jentic vault. The agent never sees the secret — Jentic mints scoped execution tokens, so even a fully compromised agent prompt cannot leak the relying-party credential.

Intent-based discovery

Agents call Jentic search with intents like 'authenticate a French user' and Jentic returns the matching FranceConnect operations (/authorize, /token, /userinfo) with their input schemas, so the agent can complete the OIDC flow without parsing the spec.

Time to first call

Direct FranceConnect integration: 1-2 weeks for OIDC flow, JWKS validation, session-end handling, and DINUM convention. Through Jentic: under 1 hour to wire up the operation calls, plus the same partnership lead time.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

Auth0

Auth0 provides general-purpose OpenID Connect identity rather than French civil-status federation

Choose Auth0 for global SaaS authentication; choose FranceConnect when the relying party must accept verified French government identities.

Alternative

ID.me

ID.me is the equivalent identity federation service for US government and commercial relying parties

Choose ID.me for US users; choose FranceConnect for French residents who already hold tax, health, or postal credentials.

Complementary

Okta

Okta can broker FranceConnect as one of several upstream identity providers in an enterprise SSO setup

Use Okta when an application needs FranceConnect plus other social or enterprise IdPs through a single integration point.

FAQs

Specific to using FranceConnect API API through Jentic.

What authentication does the FranceConnect API use?

FranceConnect implements OpenID Connect. The /token endpoint authenticates the relying party with client_id and client_secret, and /userinfo accepts the access token as a bearer token in the Authorization header. Through Jentic, the client_secret is stored encrypted in the vault and never reaches the agent.

Can I retrieve a French user's civil-status claims with the FranceConnect API?

Yes. After completing the OpenID Connect flow, call GET /userinfo with the bearer access_token. The response includes given_name, family_name, birthdate, birthplace, gender, and email — all verified by an upstream French identity provider such as impots.gouv.fr or ameli.

What are the rate limits for the FranceConnect API?

FranceConnect does not publish hard per-client rate limits in its specification. Production access is gated by a partnership agreement with DINUM and the limits are negotiated per use case; staging environments accept a few requests per second.

How do I terminate a FranceConnect session through Jentic?

Search Jentic for 'end FranceConnect session', load the /session/end schema, and execute it with the id_token_hint returned earlier from /token. FranceConnect propagates the logout to other federated relying parties so single sign-out is enforced.

Is the FranceConnect API free?

FranceConnect is provided free of charge to French public-sector services and to private-sector relying parties that meet the eligibility criteria defined by DINUM. Onboarding requires a signed convention de service before production credentials are issued.

How do I validate a FranceConnect ID token signature?

Fetch the JWKS document from GET /jwks, locate the key with the matching kid header on the ID token, and verify the RS256 signature. The discovery document at /.well-known/openid-configuration tells you which signing algorithms are advertised for the current environment.