Beyond Identity integration

Beyond Identity provides phishing-resistant, passwordless authentication and device trust. Connecting your Beyond Identity tenant to Nametag as a directory adds a strong, verifiable answer to “is this really the right person?” at the highest-risk moments — enrolling a new device, recovering access, or stepping up before a sensitive action — by verifying a government-issued ID and a real-time selfie rather than relying on a knowledge-based check or a help-desk call.

How it works

Nametag verifies the identity of the person and confirms that they match an existing account in your connected Beyond Identity tenant before a privileged Beyond Identity operation proceeds. The typical pattern is:

• A user needs to enroll, re-enroll, or recover access.
• The user is directed to Nametag to verify their identity with a government-issued ID and biometric verification.
• Nametag confirms the verified identity belongs to the expected account.
• The Beyond Identity flow continues, now backed by a high-assurance proof of identity.

Because the Nametag verification result is available over OpenID Connect (OIDC) and the Nametag API, it can be inserted into Beyond Identity access policies and recovery workflows.

Create an OAuth 2.0 client in Beyond Identity

Nametag calls the Beyond Identity API using an OAuth 2.0 confidential client (client-credentials grant) that you create in your own tenant. The credential is Beyond Identity’s, not a Nametag key. Which console you use, and which fields Nametag needs, depends on which Beyond Identity API version your tenant is on.

If you’re using the Beyond Identity v0 API:

1. Sign in to the Beyond Identity console at admin.byndid.com.
2. Go to Settings → API Access.
3. Copy your Client ID and Client Secret — you’ll paste them into Nametag below.

If you’re using the Beyond Identity v1 API:

1. Sign in to the Beyond Identity console at console.beyondidentity.com.
2. Go to API Access → External Protocol.
3. Copy your Client ID, Client Secret, Tenant ID, Realm ID, and Application ID — you’ll paste them into Nametag below.

Configure Nametag

1. Sign in to the Nametag console.
2. Select Integrations in the left-hand navigation.
3. Select New integration.
4. Choose Beyond Identity from the list of providers.
5. Enter the Base URL for your tenant (for example https://api-us.beyondidentity.com), the Client ID, and the Client Secret. If you’re on the v1 API, also enter the Application ID, Realm ID, and Tenant ID.
6. Press Connect to Beyond Identity.

Nametag checks that the base URL matches a recognized Beyond Identity API host before connecting.

Building a custom flow

The Nametag API reference and Browser SDK let you trigger verification and consume the result from any application, if you’d rather integrate directly instead of using the Nametag console connection above.