Guidance
Integrating with Commonwealth ID
How to add Commonwealth ID sign-in to a public service, which assurance level to ask for, and what your service must not do with an identity.
When you need identity at all
Most services do not need to know who someone is. Guidance, information, and anonymous reporting should never ask for an account, and asking anyway is one of the most common reasons a service fails assessment on data minimisation.
Integrate when your service acts on a specific person's record, or when getting the wrong person would cause harm.
Choosing an assurance level
Commonwealth ID offers three assurance levels. Ask for the lowest that fits the risk of your service, because each level up excludes more people from being able to use it.
- Level 1 — the account is real and the email is confirmed. Suitable for saving progress and receiving updates.
- Level 2 — the person's identity has been verified against a document. Suitable for most services acting on a personal record.
- Level 3 — verified in person at a Commonwealth Service Point. Reserved for services where impersonation would cause serious harm.
What your service must not do
You must not store the identity evidence itself, only the assurance level and the account identifier we return. You must not use the identifier to link records across services without a lawful basis and a published purpose.
You must not require a higher assurance level than your service was approved for, and you must not present a Commonwealth ID sign-in screen you have built yourself.
Getting approved
Build against the integration sandbox first — it is open and needs no approval. When your service is ready, send us the assurance level you need, why, and your data protection impact assessment.
Approvals take about three weeks. Most delays are caused by a service asking for level 3 without explaining why level 2 is not enough.
Related guidance
The Commonwealth Service Standard
The fourteen points every Commonwealth public service is assessed against before it launches, and every three years after that.
Using the Commonwealth Design System
The components, patterns, and styles Commonwealth services share, and when it is right to build something that is not in the system.
Services this guidance applies to
Commonwealth ID
Create one verified account and use it to sign in to every Commonwealth public service that needs to know who you are.
Commonwealth Hosting
Run a public service on shared, monitored infrastructure that already meets the Commonwealth's security and availability requirements.