Authorization Getting started Maskinporten

Setting up Maskinporten client

This page describes the process of setting up a Maskinporten client

To use the Altinn API, several scenarios require a Maskinporten client:

Calling the Altinn API as an organization
Authenticating as an enterprise user
Authenticating as a system user

Setting up the Maskinporten Client

Maskinporten clients are created in the self-service portal:

For the production environment, clients are created from: https://sjolvbetjening.samarbeid.digdir.no.
For the test environment, clients are created from: https://sjolvbetjening.test.samarbeid.digdir.no.

Start by logging into your account with your chosen method.
When logged into your account, the organisation you represent is shown in the top menu to the right.
The organisation you represent is shown in the top menu.
If you logged in to represent a synthetic organisation, you will also be able to change the synthetic organisation you represent in the drop down menu on that item.
You can change the synthetic organisation you represent in the drop down menu.
Select the Create client button to start creating a new client for the organisation you represent.
On the Add client page select Maskinporten.
On the Add Maskinporten client page fill in the display name, description and add your required scopes (these values can also be changed later). Then click the Create button.
The 'Add Maskinporten client' page.
You have now created a Maskinporten client for your organisation. To use this client you need to add at least one authentication key. The client supports JWK and PEM keys. Start by either locating an existing key or creating a new one. You can use the Altinn JWKS tool or other key generator of your choice for this. Next, navigate to the key section on your client page and select Add.
Keys can be added in the key section.
In the JWK or PEM format field paste your public key and click Save. The key is now added to the client. Store your private key from your JWK or PEM in a secure location, as it is used to authorize the use of this client. If you use Azure Key Vault to store your private keys, they need to be base64-encoded before uploading.
The JWK or PEM public key is pasted in this field
If you didn’t do so in step 5, you need to add the desired scopes to your client before it can be used.
From the Scopes tab on your client definition, click the Add button.
Scopes available to your organisation will be shown in the list. Select the required ones and click Submit.

Scope list

Depending on your usage, you will need to add the relevant scopes to your client. In the table below you will find a collection of commonly used scopes:

Scope	Usage	Description
altinn:instances.read	Altinn Apps API read
altinn:instances.write	Altinn Apps API write
altinn:authentication/systemregister	Access to system register	For system providers that need to manage systems available in system register
altinn:authorization/authorize	Access to PDP endpoint	For orgs that need to authorize access

For a list of legacy scopes, please refer to the Altinn 2 docs.

Authentication

A detailed description on how to authenticate your client with a JWT Grant is described here.

In the context of an Altinn Studio app, integration with Maskinporten is available using the built-in authentication client. Simply follow along with the user guide to get started.

For other .Net apps, you can use this standalone library to handle authentication. The library provides extension methods to configure HttpClients to authenticate with Maskinporten based on your provided configuration.