Fraud alert via SMS and phone calls. Do not open suspicious links and never share codes, passwords, or bank details. Report fraud

MPass integration procedure

What is MPass?

MPass is the governmental authentication and access control service. For citizens, it is the secure way to access online government services with a single identity. For you, the one integrating with MPass, it is the way to give your users secure access without having to take care of the authentication infrastructure yourself.

A single access point, multiple methods: electronic signature, EVOSign, identity card and 2-step authentication.

Legal basis: Government Decision No. 1090 of 31 December 2013.

Do you want to connect an information system to MPass?

The cost of the integration depends on the type of your institution. Check below what applies in your case:

Type of institution Cost
Public institutions Free
Individuals or private legal entities that own their own information systems 10 800 MDL/year per system*

*Fee approved by AGE Order No. 3005-09 of 12.03.2020

Steps

  1. Fill in the connection form;
  2. Sign the electronic contract via MSign.If you already have a contract with AGE, you only sign the annex; see the contract template here;
  3. Obtain a system certificate from the Information Technology and Cyber Security Service (STISC) for the test environment and a separate one for the production environment;
  4. Fill in the technical integration form;
  5. Receive access to the test environment and check that everything works;
  6. Pass the functional and security tests;
  7. We activate the production environment.
Processing time: up to 5 working days from the moment we receive all the required data.

Need technical details? The complete documentation (SAML 2.0 configuration, endpoints, code samples and integration libraries) is available on the eGov4Dev developer portal.

Before you start. What do you need to prepare?

  • System certificate requested from the Information Technology and Cyber Security Service (STISC).

    Do you already have a system certificate issued by STISC and used for other government services (MSign, MPower, MNotify)? You can use it for all "M" products within the same environment (test or production). A separate certificate issued by STISC is required for each environment (test and production).

  • Public key (.cer). Send only the .cer file. Do not send files that contain the private key: .pfx, .key or .pem.
  • Active contract with AGE. If you already have one, you only sign the MPass annex.

Having difficulties?

Haven't received the system certificate?
Check with STISC whether your request has been received. If you already have a system certificate issued by STISC for MSign, MPower or MNotify, you can use it for the MPass test environment.
Is the certificate invalid or expired?
Request STISC to issue a new certificate for the test or production environment and send the new public key (the .cer file) to AGE at servicii@egov.md. An expired certificate can no longer be used in MPass.
The integration does not pass the tests?
AGE will send you the necessary remarks and recommendations. After making the corrections, request a retest at servicii@egov.md.
Can the same certificate be used for test and production?
No. Each environment uses a separate system certificate issued by STISC. However, the same certificate can be used for several "M" products (MPass, MSign, MPower, MNotify) within the same environment. Request the production certificate after the tests have been successfully completed.
Is the submitted data incomplete?
The 5 working day term is counted from the date AGE receives all the required information. If the form is incomplete, AGE will ask you to complete it, and the term will be counted from the date the complete data is received.

Are you a digital identity provider?

If you are a digital identity provider and want to integrate an automated identity verification mechanism into MPass, follow the steps below:

  1. Fill in the integration request form;
  2. Send the technical documentation to servicii@egov.md;
  3. Sign the electronic contract via MSign;
  4. AGE analyzes the documentation and plans the integration work;
  5. AGE configures the test environment;
  6. You receive AGE's confirmation to start testing;
  7. Pass the functional tests;
  8. AGE confirms the technical acceptance;
  9. AGE activates the production environment.

Need technical details? The technical documentation is available on the eGov4Dev developer portal.

What the technical documentation must contain

Before starting the integration, send to servicii@egov.md:

  1. Information about the issued certificates and the CA used – certificate profile, OIDs, type of qualified signature creation device (QSCD), compliance with the legislation of the Republic of Moldova on electronic signature;
  2. Description of the technical mechanism for accessing the certificate – remote API or local driver/component, including the protocol/SDK required to integrate MPass with this mechanism;
  3. The dedicated API for certificate validation – direct OCSP without a dedicated API is not accepted;
  4. The endpoint and access for the TEST environment, including the client components required for testing;
  5. The mechanism for handling operation cancellation and expiration;
  6. Specific error codes and messages, including notifications/callbacks for asynchronous operations;
  7. The data/identities required for testing;
  8. Contact details of the responsible technical person;
  9. The name and logo of the QTSP operator to be displayed in MPass.