eID Platform — Developer documentation

Architecture, integration and PKI documentation for Mongolia's national eID (Smart-ID / eIDAS style) platform. A single codebase serves both the eID Mongolia and Gerege brands.

Where to start?

• Integrating as a relying party (RP)? → RP integration · TypeScript RP SDK · Web RP demo · RP subsystems
• Building a mobile / client app? → iOS SDK · Android SDK · macOS desktop · Windows desktop
• Registering an organization? → Organization onboarding
• Operator / Admin console → Admin console
• Certificates / CA → CA onboarding
• Citizen/organization identifiers → Identifiers

What does the platform do?

• 2-of-2 threshold ECDSA (Lindell, 3 rounds) — the signing private key never exists in one place in full: one share on the phone, one share on the server.
• Dual key, 2 certificates per citizen — Authentication (PIN1, login) and Signing (PIN2, legally-binding signature). Details: Two-certificate eID.
• Identity = civil_id — the ETSI ID is PNOMN-<civil_id> for a natural person, NTRMN-<...> for an organization. Details: Identifiers.
• KYC via DAN, liveness check via ArcFace face matching.

Structure

Component	Technology	Role
server/	Go (chi + pgx)	RP-API backend: enroll, threshold signing, CA/OCSP/CRL, admin, KYC
web/	Next.js 16	Browser RP demo (QR / push login and signing)
admin/	Next.js 16	Admin console — RP/user/certificate/session management
ios/	Swift	GeregeSmartID SDK + eID Mongolia app
android/	Kotlin/Compose	mn.eidmongolia.smartid SDK + example app
desktop/	Swift + .NET	macOS / Windows RP client + USB token kit
sdk/	TypeScript	RP-side SDK (@eid-mongolia/sdk)

Wire compatibility

The Go server and the iOS/Android SDKs all speak one fixed protocol (inherited from the original Java system). Crypto serialization must be byte-identical across every side. This contract is guaranteed by a frozen fixture.

---

This documentation is generated automatically from the markdown files in docs/. To edit, use the ✏️ button in the top-right corner of each page.