1Kosmos BlockID is a passwordless identity-proofing platform: it verifies a real person with documents and biometrics, then authenticates them without a password. It belongs on flows where knowing who the user actually is matters more than convenience.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **1Kosmos BlockID**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the application

1. Create an OIDC application in your 1Kosmos BlockID tenant.
2. Add the redirect URI from Authdog to the application's redirect URIs.
3. Copy the issued **Client ID** and **Client Secret**.
4. Note your tenant host — that is the Domain URI.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | The client identifier from the provider |
| **Client Secret** | The client secret from the provider |
| **Domain URI** | Your 1Kosmos tenant host |

Save, then toggle the connection **active**.

> **Caution**
>
> Authdog substitutes the Domain URI into this provider's endpoints for
> AWS Cognito, Salesforce Community, Shopify, Klarna, and Keycloak. This
> connector accepts the field in the console but is not covered by that
> substitution on both legs of the flow, so verify it end to end in a
> development environment before you rely on it in production.

## What 1Kosmos BlockID returns

Authdog requests the `openid profile email` scopes and reads the profile from ``https://<domain>/userinfo``.

The tenant's userinfo endpoint returns the standard OpenID Connect claims for the verified identity.

Proofing happens in BlockID, before Authdog sees the user. Treat the resulting session as high assurance only if the tenant's proofing policy actually requires it.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the 1Kosmos BlockID button and complete the flow.
3. Confirm the user appears under **Users** in the console with a 1Kosmos BlockID identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `invalid_client` | The application belongs to a different tenant than the Domain URI |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own `connectionId`, and so its own redirect URI to register |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |