# GoPaperless SSO SaaS for banking

A proposal for adding OIDC/FAPI and Passkey sign-in and Palm/Facial verification to an existing banking channel. Three integration points are separated: BFF for sign-in, Web SDK for interaction and Backend for evidence validation. Transaction decisions and posting remain with the financial institution.

## Problem

A valid sign-in session does not by itself authorise a financial instruction. Biometric capture, authentication evidence and Core outcomes have separate lifecycles; uncertain results require reconciliation against the original instruction.

## Scope

- Passkey sign-in through OIDC, with project-specific validation of the security profile and token binding.
- Palm 1:1 and Facial through an embedded SDK are proposed contracts requiring an actual SDK and device/model acceptance.
- The Backend obtains and validates evidence before applying transaction policy.

## Boundaries

An SDK callback is not server-side evidence. The appendix API, Web SDK and Capture contracts are proposals; the document does not establish a released production SDK.

## Prerequisites

- Agree methods, device model, firmware, OS/browser, camera permissions and fallback.
- Prepare the BFF, Backend, sandbox and Core deduplication/status contracts.

## Pilot

Choose one transaction and user cohort. Test wrong origins, instruction mismatch, expired evidence, forged callbacks and uncertain Core results; the business owner determines execution readiness.

## Source document

https://docs.mobile-id.vn/Proposals/MobileID_GoPaperless_SSO_SaaS_Banking_Proposal_V9.pdf

V9; 42 pages; Vietnamese PDF.

Observed source version; confirm implementation scope.
- Value and scope: 3
- Architecture and integration points: 6
- Authentication journeys: 13
- Readiness and ownership: 20
- Proposed technical contracts: 28
- Testing and evidence: 37