Skip to main content

Configuring Nametag as a Delegate Identity Provider (IDP) for Beyond Identity

  • Updated

Overview

Nametag provides verified identity authentication using secure, government-issued ID verification. It enables organizations to verify users’ real-world identities quickly and safely, reducing fraud and improving risk while increasing trust in identity assertions.

This integration allows organizations to:

  • Synchronize users from Beyond Identity Directory into a Nametag tenant, and

  • Use Nametag as a delegate OIDC Identity Provider (IDP) during enrollment flows that are authorized through another IDP.

Once configured, users authenticating through your primary IDP can be additionally verified by Nametag during enrollment.

This configuration is managed primarily within:

  • Nametag Console, and

  • Beyond Identity Admin Console.

 

Prerequisites

Before proceeding, ensure you have:

  • Administrative access to the Nametag Console

  • Administrative access to the Beyond Identity Admin Console

  • A working Beyond Identity tenant with Directory enabled

  • A working Nametag tenant

Recommended: Create a separate Nametag test environment before configuring in production.

 

Part 1 — Directory Synchronization

(Sync users from Beyond Identity into Nametag)


Step 1 — Select the correct Nametag environment

In Nametag Console:

  1. Confirm you are in the correct Nametag environment (Test or Production).

  2. If needed, create a new environment for testing.

 

Step 2 — Create a Beyond Identity Directory in Nametag

In Nametag Console:

  1. Navigate and click Configure.

    1.png

    2. Click Directories from the left-hand navigation. 

    2-E.png

    3. Then, click Add a directory.

    3.png

    4. Then, select Beyond Identity from the list. 

    4.png

     

  2. Stay on this page, you will need values from Beyond Identity in the next steps.

 

Step 3 — Create Outbound Provisioning in Beyond Identity

In Beyond Identity Admin Console:

  1. Click Integrations. 

    5-e-3.png

  2. Select the Outbound Provisioning tab. 

    6-e.png

  3. Select Nametag and click the install icon. 

    click-nametag.png

     

 

Step 4 — Map Beyond Identity values into Nametag

You will now transfer values from Beyond Identity into Nametag.

  1. From the Beyond Identity Nametag application you just created, copy the following values and enter them into the Nametag Console directory configuration:

FieldDescription
Base URLAPI base URL for Beyond Identity
Tenant IDYour Beyond Identity tenant ID
Realm IDYour Beyond Identity realm ID
Application IDBeyond Identity application ID in Nametag
Client IDOAuth Client ID issued by Beyond Identity
Client SecretOAuth Client Secret issued by Beyond Identity

 

2. When you are done, click Save Changes. 

7.png

 

Step 5 — Connect and validate sync

In Nametag Console:

  1. Click Connect to Beyond Identity.

    8-e.png

  2. Confirm that identities from Beyond Identity are successfully synchronized into Nametag.

    9.png

 

Step 6 — Record the Nametag Directory Client ID

In Nametag Console:

  • Copy and save the Client ID associated with this directory.

  • You will need this in Part 2.

 

Part 2 — Configure Nametag as a Delegate IDP in Beyond Identity

This section enables Nametag to act as an OIDC identity provider within your existing IDP enrollment flow.

 

Step 1 — Add Generic OIDC Provider in Beyond Identity

In Beyond Identity Admin Console:

  1. Click Identity Providers from the left-hand navigation, then click Add Identity Provider.

    11.png

2. In the dialog window, enter the following values:

FieldValue
Display NameNametag
Client ID(Use the Client ID from Part 1, Step 6 — this is your Nametag Directory Client ID, not a new one)
Client SecretCreate a new API key in Nametag (see Step 2a below)
Token Scopesopenid
PKCEDisabled
Token URLhttps://nametag.co/oauth2/token
Token Endpoint Auth Methodclient_secret_basic
Authorization URLhttps://nametag.co/oauth2/authorize
JWKS URLhttps://nametag.co/.well-known/jwks
Identifying Attributeid
Identifying Claim Nameaccount.immutable_external_id
Requested Claims{"id_token":{"account":null}}
OAuth 2PAREnabled
PAR Endpointhttps://nametag.co/oauth2/par

 

Step 3 — Generate Client Secret in Nametag

In Nametag Console:

  1. Navigate to OAuth → Create new API Key

    12.png

  2. Generate a new secret

  3. Copy only the secret (do not reuse the Client ID here)

  4. Return to Beyond Identity and paste this into Client Secret.

 

Step 4 — Save Configuration

In Beyond Identity Admin Console:

  1. Paste the Client Secret from the previous section. 

  2. Click Save Changes.

    13.png

 

Step 5 — Register Redirect URI in Nametag

In Beyond Identity Admin Console:

  1. Copy the Redirect URI generated for this OIDC instance.

Then, in the Nametag Console:

  1. Go to OAuth settings

  2. Add this value as an Authorized Callback URL

 

Final State — What you now have

After completing these steps:

  • Users from Beyond Identity are synchronized into Nametag.

  • Nametag is registered as a delegate OIDC IDP.

  • You can now create enrollments that require Nametag verification during IDP authorization.

You are now ready to use Nametag as part of your identity proofing workflow.

 

 

 

 

 

Related articles

Comments

0 comments

Article is closed for comments.