FranceConnect API

Name: FranceConnect API
Brand: FranceConnect API
Availability: InStock

✓ Official Vendor SpecIdentity AuthAuthenticationbearer7 EndpointsREST

For Agents

Authenticate French citizens via OpenID Connect against FranceConnect and exchange the resulting code for an ID token plus verified identity claims. Bearer-token authorisation on the userinfo endpoint.

Install Jentic One Beta

Connect the FranceConnect API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the FranceConnect API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ffranceconnect.gouv.fr%2Ffranceconnect" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Ffranceconnect.gouv.fr%2Ffranceconnect" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with FranceConnect API.

Redirect users to /authorize to start an OpenID Connect login against FranceConnect identity providers

Exchange an authorisation code for an ID token and access token at /token

Fetch verified identity claims (given_name, family_name, birthdate, birthplace, gender, email) from /userinfo

GET STARTED

Start building with FranceConnect API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use FranceConnect API for, with concrete tasks.

★ Public Service Login Federation

A French e-government service redirects users to FranceConnect, lets them choose any approved identity provider, and receives back a signed ID token plus verified civil-status claims. The integration replaces a custom login flow with a state-recognised identity check that satisfies eIDAS substantial assurance.

Build the /authorize redirect URL with client_id, redirect_uri, scope=openid profile email, then exchange the returned code at /token for an id_token

Private-Sector KYC Onboarding

A French bank or insurer uses FranceConnect to verify a new customer's civil status without asking them to upload ID documents. After the user authenticates, /userinfo returns government-validated given name, family name, and birthdate that can be persisted to the customer record. This shortens onboarding from days to minutes.

Call GET /userinfo with the bearer access_token returned from /token and persist the given_name, family_name, birthdate, and birthplace claims to the customer record

Single Sign-Out Across Government Sites

When a user logs out of one FranceConnect-federated service, the session must end across all other FranceConnect sessions. Calling /session/end with the id_token_hint terminates the federated session and notifies other relying parties, which is mandatory for compliance with the FranceConnect technical specification.

Redirect the user to /session/end?id_token_hint={id_token}&post_logout_redirect_uri={return_url} to terminate the FranceConnect session

AI Agent Identity Verification

An agent acting on behalf of a French citizen uses FranceConnect through Jentic to obtain verified civil-status claims, then calls a downstream administrative API on the user's behalf. Jentic isolates the client_secret in the vault and returns only the resolved identity claims to the agent's context.

Search Jentic for 'authenticate a French user via FranceConnect', execute the /authorize and /token flow, and return the verified userinfo claims

Key Endpoints

7 endpoints — franceconnect is the french government's identity federation service that lets citizens sign in to public and private service providers using credentials they already hold (impots.

METHOD

PATH

DESCRIPTION

GET

/.well-known/openid-configuration

Read the OpenID Connect discovery document

GET

/authorize

Start the OpenID Connect authorisation flow

POST

/token

Exchange an authorisation code for an ID token

GET

/userinfo

Fetch verified identity claims for the authenticated user

GET

/jwks

Retrieve the JSON Web Key Set for ID token validation

GET

/session/end

Terminate the FranceConnect session

GET

/.well-known/openid-configuration

Read the OpenID Connect discovery document

GET

/authorize

Start the OpenID Connect authorisation flow

POST

/token

Exchange an authorisation code for an ID token

GET

/userinfo

Fetch verified identity claims for the authenticated user

GET

/jwks

Retrieve the JSON Web Key Set for ID token validation

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the FranceConnect API by hand means implementing the full OpenID Connect flow across /authorize, /token, and /userinfo, managing the bearer token, and building your own retry and error handling. Through Jentic you install once, import FranceConnect from the API Directory, store the relying-party credentials once, and your agent calls it.

Permission scoping

FranceConnect is an OpenID Connect federation with fixed flow endpoints and carries its parameters in the query and request body rather than as path resources, so scoping is operations-only: you limit the agent to the operations it needs, such as /authorize, /token, and /userinfo, and leave out session end unless you add it. Every operation the agent can run is one you chose.

Credential isolation

Your FranceConnect client_id and client_secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'authenticate a French user', and Jentic returns the matching FranceConnect operations (/authorize, /token, /userinfo) with their input schemas so the agent completes the OIDC flow without parsing the spec.

FAQs

Specific to using FranceConnect API through Jentic.

What authentication does the FranceConnect API use?

FranceConnect implements OpenID Connect. The /token endpoint authenticates the relying party with client_id and client_secret, and /userinfo accepts the access token as a bearer token in the Authorization header. Through Jentic, the client_secret is stored encrypted in the vault and never reaches the agent.

Can I retrieve a French user's civil-status claims with the FranceConnect API?

Yes. After completing the OpenID Connect flow, call GET /userinfo with the bearer access_token. The response includes given_name, family_name, birthdate, birthplace, gender, and email - all verified by an upstream French identity provider such as impots.gouv.fr or ameli.

What are the rate limits for the FranceConnect API?

FranceConnect does not publish hard per-client rate limits in its specification. Production access is gated by a partnership agreement with DINUM and the limits are negotiated per use case; staging environments accept a few requests per second.

How do I terminate a FranceConnect session through Jentic?

Search Jentic for 'end FranceConnect session', load the /session/end schema, and execute it with the id_token_hint returned earlier from /token. FranceConnect propagates the logout to other federated relying parties so single sign-out is enforced.

Is the FranceConnect API free?

FranceConnect is provided free of charge to French public-sector services and to private-sector relying parties that meet the eligibility criteria defined by DINUM. Onboarding requires a signed convention de service before production credentials are issued.

How do I validate a FranceConnect ID token signature?

Fetch the JWKS document from GET /jwks, locate the key with the matching kid header on the ID token, and verify the RS256 signature. The discovery document at /.well-known/openid-configuration tells you which signing algorithms are advertised for the current environment.

Can I limit what my agent is allowed to do with the FranceConnect API?

Yes. Because you run Jentic One yourself, your own rules decide which FranceConnect operations the agent can call and which credentials it may use. FranceConnect is an OpenID Connect federation with fixed flow endpoints, so scoping is operations-only: you can allow just the operations the agent needs, such as /authorize, /token, and /userinfo, and leave out /session/end unless you deliberately add it. Every operation the agent can run is one you chose, and your relying-party client_id and client_secret stay in your own instance rather than the agent's context.