Login with an E-IMZO digital signature

The user signs a one-time challenge with their key; your server verifies the signature and finds the user by PINFL or TIN.

Flow

1. The browser asks your backend for a challenge. The backend gets it from e-imzo-server (GET /frontend/challenge, valid for 120 seconds).
2. eimzo-ts loads the selected key and signs the challenge. E-IMZO asks for the password.
3. The browser posts the PKCS#7 to your backend. The backend calls POST /backend/auth on e-imzo-server, which checks the signature, the certificate and the challenge.
4. The backend finds the user by PINFL (OID 1.2.860.3.16.1.2) or TIN (1.2.860.3.16.1.1, or UID) and opens a session.

Frontend

import { createEimzo, createFetchBackend, DEV_API_KEYS, isEimzoError } from 'eimzo-ts';

export const eimzo = createEimzo({
  apiKeys: { ...DEV_API_KEYS },
  backend: createFetchBackend({
    challengeUrl: '/api/eimzo/challenge',
    loginUrl: '/api/eimzo/login',
    init: { credentials: 'include' },
  }),
});

const keys = (await eimzo.listKeys()).filter((k) => !k.expired);

try {
  const user = await eimzo.login(keys[0]); // returns what /api/eimzo/login returned
} catch (e) {
  if (!isEimzoError(e, 'CANCELLED')) alert(eimzo.t(e));
}

Create the client once per application: E-IMZO remembers the password per loaded key, and a new client would load the key again.

Backend endpoints

X-Real-IP is the user's IP from your trusted proxy; Host is your site's domain from configuration. In Java, the built-in HTTP clients refuse to set Host: use Apache HttpClient 5 or the JVM flags described in the backend guide (Russian, with a Spring Boot example).

/backend/auth statuses

Logout

await eimzo.unloadKey(); // removes the key and its remembered password from E-IMZO

Next: signing documents and files · troubleshooting