Announcing Native BC Services Card (BCID) Integration with LoginRadius

The Need for High Identity Assurance in British Columbia

British Columbia is home to over 5 million residents who regularly interact with a vast array of provincial government services. From health authorities and permit offices to social benefit programmes, most services are delivered digitally nowadays.

For organizations delivering these essential digital services, standard authentication simply is not enough. These platforms demand a high level of identity assurance. The system must know, with absolute confidence, that the person logging in is exactly who they claim to be.

The BC Services Card or BCID is the provincial government’s answer to the modern challenge of digital identity. Issued to BC residents, it is a unified solution that combines a physical identity card with a highly secure, government-verified digital credential. This digital identity isn't just a simple email confirmation; it is backed by strict, in-person identity proofing conducted at Service BC centres.

When a user authenticates using their BC Services Card, the trust is derived directly from the province itself. Hence, it completely removes the unreliability of self-registered usernames or standard social logins.

That is why, a few of our customers operating in the region had requested us to introduce BCID integration into our platform. And we have heard them!

We are thrilled to announce LoginRadius's native integration with the BC Services Card (BCID) infrastructure. LoginRadius now supports this using standards-based protocols like OAuth 2.0 and OpenID Connect.

Furthermore, because LoginRadius is a CIAM platform built and headquartered right here in Vancouver, British Columbia, we ensure 100% Canadian data residency and seamless alignment with FOIPPA compliance requirements.

The Problem vs. The Solution: Why We Built Native BCID Integration

Historically, building a trusted, high-assurance identity verification system from scratch typically meant months of complex engineering, exhaustive reviews, and expensive ongoing maintenance.

Additionally, forcing BC residents to create yet another unique username and password for a new portal inevitably led to increased drop-off rates. And it also levied a heavy ongoing IT support burden for password resets.

Worst of all, organizations were forced to rely on self-asserted identity data - meaning users simply typed in their own name and email. The system did not have any authoritative way to verify if the information was genuine. Managing these sensitive credentials for government-adjacent services also introduced high compliance risk, drastically increasing an organization's audit scope and liability.

Our new native BCID integration solves these issues by allowing you to delegate identity verification entirely to the provincial government.

By implementing BCID via LoginRadius, organizations immediately unlock several critical advantages:

• A Frictionless User Experience: Users log in using a credential they already possess and trust. This familiarity results in significantly fewer abandoned sessions and drastically lowers password reset volumes.

• Government-Proofed Data: You can effectively eliminate identity spoofing and self-asserted data. Your application now receives verified, government-proofed identity attributes—such as the user's name, email, and a unique sub ID—delivered directly from BC Services.

• Significantly Reduced Compliance Scope: Because the credential ownership and verification process stays with the province of British Columbia, your application only receives the verified claims. This fundamentally reduces your compliance scope, as you are no longer responsible for storing, securing, or managing the underlying authentication credentials.

• Unmatched Time to Market: This integration requires absolutely zero custom verification infrastructure. With a configuration-only setup managed entirely within the LoginRadius Admin Console, your team can go from a signed contract to a live, government-grade login experience in a matter of days, rather than quarters.

Who Is This For? - Target Use Cases

Any organization delivering digital services to BC residents needs a frictionless, trusted way to verify exactly who is logging into their system.

Whether you are a public sector agency or a private vendor partnering with the government, BCID is the only government-issued credential in British Columbia that meets this high bar out of the box.

This integration is purpose-built to accelerate digital delivery for several key sectors:

• Municipalities & Regional Districts: Local governments can build highly secure, trusted resident portals for services like utilities, licensing, and permits. We already partner with local BC municipalities, such as supporting the City of Surrey in building the highly successful MySurrey Portal.

• Health Authorities: The integration ensures bulletproof, verified patient identities, which is a strict necessity for online health portals, electronic health records, and virtual appointment systems.

• Public Sector & Crown Corporations: Provincial agencies can confidently deliver digital services and social benefit programmes while maintaining full data residency and FOIPPA compliance.

• Private-Sector Partners & SaaS Vendors: Independent Software Vendors (ISVs) and private organizations contracted to deliver government-adjacent services can instantly meet BC government identity compliance mandates. Having pre-built IdP support for BCID secures a massive competitive advantage when bidding on public procurement contracts.

Simply put: if your customer base operates in British Columbia and your users are BC residents, enabling BCID is the fastest path to delivering a trusted, government-grade login experience.

Under the Hood: The Technical Architecture

So, how does this integration actually work behind the scenes?

The LoginRadius BCID integration leverages the industry-standard OAuth 2.0 Authorization Code flow via OpenID Connect (OIDC). In this architecture, LoginRadius is configured as a Custom OAuth Identity Provider that securely delegates the authentication process directly to the BC Services Card infrastructure (id.gov.bc.ca).

Here is a step-by-step breakdown of the secure, server-to-server handshake that occurs when a user initiates a login:

Built-In Security Mechanisms

Security is paramount when dealing with government-issued identities and citizen data. The LoginRadius BCID integration is hardened with several built-in mechanisms out of the box to protect both your application and your users:

• Zero-Trust Token Security: Your client_secret is securely stored exclusively within the LoginRadius Admin Console. It is never hardcoded, logged, or exposed anywhere within your application code. (Note: If the secret is ever exposed, it must be rotated immediately with BC Services.)

• Built-In Anti-CSRF Protection: To proactively block cross-site request forgery (CSRF) attacks on the authorization callback, LoginRadius automatically generates and validates unique state parameters on every authentication request.

• Automated Key Management: Token signature validation is managed seamlessly by LoginRadius using the authoritative BC Services JWKS endpoint (/oauth2/jwk). No manual key management is required on your end; LoginRadius periodically re-fetches the JWKS to automatically handle government key rotation.

Step-by-Step Integration Guide

One of the biggest advantages of this native integration is that it is a configuration-only setup—requiring absolutely zero custom authentication code to implement. Here is how you can set it up:

Step 1: Prerequisites

Before configuring the integration in LoginRadius, you must obtain a Client ID and Client Secret directly from BC Services. Crucially, you must also register your whitelisted LoginRadius Redirect URI with BC Services (https://<LoginRadius TenantDomain>:443/socialauth/validate.sauth). The integration will not function until this redirect URI is registered.

Tip: Ensure your team requests separate test environment credentials for the BCID Simulation Environment during your onboarding phase with the Province, allowing you to validate your LoginRadius workflows prior to production deployment.

Step 2: Custom IDP Configuration

Log into your LoginRadius Admin Console and navigate to Authentication → Identity Provider → Add Custom IDP → Create OAuth Provider.

First, configure the core government endpoints:

• Authorization endpoint: https://id.gov.bc.ca/login/oidc/authorize

• Access token endpoint: https://id.gov.bc.ca/oauth2/token

• User profile endpoint: https://id.gov.bc.ca/oauth2/userinfo

• JWKS endpoint: https://id.gov.bc.ca/oauth2/jwk

Next, configure the application credentials and settings:

• Enter your BC Services client_id in the Application Key field and your client_secret in the Application Secret field.

• Set the Scope to openid email profile address. (Note: While included in the standard request, BC Services does not currently return a structured address claim. If your specific IDP configuration restricts unreturned scopes, you should remove the address scope).

• Set the Response type to code and the Token request HTTP method to POST.

• Crucial Compliance Step: Ensure that Extract user profile from ID token is left unchecked. This guarantees that profile claims are fetched exclusively from the authoritative /userinfo endpoint rather than standard tokens.

• Check the Include in Social Schema box so the verified profile is cleanly exposed via the Social Profile API.

Step 3: Claim Mapping

Finally, you need to map the verified claims returned by BC Services to your standard LoginRadius user fields. Set up the following mapping:

BC Government OIDC Claim	Target LoginRadius Field	Field Purpose
sub	ID	Unique Immutable Identifier
email	Email	Verified Citizen Email
given_name	FirstName	Legal Given Name
family_name	LastName	Legal Surname

Because the BC Services Card does not currently return a structured address claim despite the scope request, you can use LoginRadius Progressive Profiling to prompt users for their billing or service address seamlessly on their first successful login landing page.

Once these settings are saved, a dynamic "Login with [Your Display Name]" button will automatically populate on your unified login page, ready to authenticate BC residents!

Built for BC, by BC's Own Identity Experts

When integrating a government-issued credential, choosing the right identity partner is just as critical as the technology itself. Unlike global vendors that may route your sensitive identity data across borders, LoginRadius is a CIAM platform built and headquartered right here in Vancouver, British Columbia.

By choosing LoginRadius to power your BCID integration, you benefit from:

• 100% Canadian Data Residency: We ensure that all identity data remains strictly within Canada, keeping you perfectly aligned with provincial compliance requirements and FOIPPA (Freedom of Information and Protection of Privacy Act) mandates.

• Proven Local Success: We deeply understand the regulatory landscape and operational realities of British Columbia. As mentioned before as well, we already partner with local BC municipalities and have a proven track record, such as supporting the City of Surrey in building the highly successful MySurrey Portal.

• Hands-on Architecture Support: We don't just provide the API endpoints; our local identity experts work closely with your team to design, implement, and scale your public-sector identity architecture.

Conclusion: Accelerate Your Public-Sector Digital Delivery

Integrating with BCID on your own often means dealing with months of complex engineering, exhaustive legal reviews, and a heavy ongoing maintenance burden. By leveraging LoginRadius's native BC Services Card integration, you entirely eliminate the need to build and operate custom identity-proofing infrastructure.

For organizations operating in British Columbia, this pre-built IdP support serves as a massive competitive differentiator. It allows you to deliver a frictionless, highly secure login experience while significantly lowering your total cost of ownership and reducing your compliance scope. Ultimately, you can go from a signed contract to a live, government-grade identity solution in a matter of days, not quarters.

Ready to secure your digital services? Book a Demo today to see how we can streamline your public-sector identity architecture.