Staging and Production URLs

Corppass provides separate environments for integration and testing (Staging) and for live transactions (Production). Clients must integrate and validate their implementation against the Staging environment before switching to Production.

Environment Overview

Environment	Description
Staging	Used for development, integration testing, and pre-production validation.
Production	Live environment for real users and transactions. Must be used only after successful onboarding and certification.

NO certificate pinning or dependencies should be implemented on the TLS certificates for Corppass domains. Corppass reserves the right to update or rotate its TLS certificates without prior notice to RPs.

Base URL

Enviroment	Base URL
Staging	https://stg-id.corppass.gov.sg
Production	https://id.corppass.gov.sg

Common Endpoint Paths

Do not hardcode these URL paths in your implementation.

RPs should derive these endpoints from the OIDC discovery endpoint to avoid any unexpected behaviours.

Endpoint	Access Mechanism	Path
Pushed Authorization Request (PAR)	Public TLS w/ Client Assertions	/request
Authorization	Public TLS	/mga/sps/oauth/oauth20/authorize
Token	Public TLS w/ Client Assertions and DPoP	/mga/sps/oauth/oauth20/token
User Info	Public TLS w/ Access Token and DPoP	/userinfo
OpenID Discovery	Public TLS	/.well-known/openid-configuration
JWKS	Public TLS	/.well-known/keys