System integration · Saudi digital platforms
Nafath integration for your website, portal or app
A Nafath integration lets people sign in to your website, portal or app, or confirm a transaction, with their national digital identity. Your system sends a request, the person approves it in the Nafath app, and your system receives the result and opens a session. Nafath is developed and run by the National Information Center at the Saudi Data and Artificial Intelligence Authority (SDAIA), and your organisation's access is granted by that operator. Interkey's integration team in Riyadh has delivered a Nafath integration and builds, tests and operates your side of it.
Published 4 min read
In short
- What Nafath is: the national digital identity app and platform, developed by the National Information Center at SDAIA.
- Who can use it: government and private entities, for their own digital services.
- How a person signs in: they approve your service's request in the Nafath app, with a PIN, a request number or biometric checks, depending on the authentication level.
- Who grants access: the platform operator, to your organisation. Your registration and credentials stay yours.
- What Interkey does: scopes, builds, tests and operates your side of the integration, from Riyadh.
How Nafath sign-in works
| Step | What happens | Where it happens |
|---|---|---|
| 1. Start | The person chooses to sign in or confirm with Nafath | Your website, portal or app |
| 2. Request | Your back end sends an authentication request | Your back end to Nafath |
| 3. Approve | The person opens the Nafath app and approves the request, confirming their identity as the authentication level requires | The person's phone |
| 4. Result | Your back end receives the result of the request | Nafath to your back end |
| 5. Session | You match the identity to a user record and open a session, or decline | Your system |
The Nafath app is also the central point where people accept requests from both government and private services.
Authentication levels: matching Nafath to the service
Nafath offers authentication levels matched to how sensitive a service is. Its published case material describes three:
| Level | Factors |
|---|---|
| High | PIN, request number and central biometric verification |
| Moderate | PIN and request number |
| Low | PIN or request number |
Choose the level per action, not per system. Viewing a profile and approving a payment may need different levels in the same app. Agree this with your security team before the build starts, because it shapes the user journey and the tests.
Nafath integration steps
-
Scope the use.
Decide where Nafath is used: sign-in, identity checks when an account is opened, or approval of a sensitive transaction. Set the authentication level for each.
-
Request access from the operator.
Your organisation applies as the service provider, following the operator's process and terms. The registration and credentials belong to your organisation. Interkey prepares the technical information the application asks for.
-
Build against the operator's specification.
Use the integration documentation and test environment the operator provides to your organisation. Build the failure paths as well as the happy path.
-
Map identities.
Decide how a Nafath identity links to your user records: new users, existing users, and people whose details do not match.
-
Handle sessions and consent.
Set session length, sign-out and re-authentication for sensitive actions, and tell users what is shared.
-
Log for audit, not for exposure.
Record each request and its outcome, without storing more personal data than you need.
-
Go live and operate.
Move to production with written responsibilities for credential renewal, changes announced by the operator and incident handling.
Two ways to connect
| Approach | How it works | When it fits |
|---|---|---|
| Direct integration | Your application's back end calls Nafath and handles the result | One application, or a team that owns its own sign-in |
| Through an identity and access layer | A central identity provider handles Nafath once, and your applications sign in through it | Several portals and apps that should share one sign-in |
For the second approach, the Digital Government Authority's open-source platform lists a government open-source add-on that connects the Keycloak identity server to Nafath. Whether it fits depends on the identity platform you already run.
What usually goes wrong, and how to plan for it
- The person does not approve in time, or declines. Show a clear retry and an alternative route.
- Identity details don't match your records. Decide in advance who resolves a mismatch, and how.
- A credential expires or is rotated. Track expiry dates and assign an owner, so sign-in does not stop without warning.
- The operator changes its interface. Monitor operator notices and test changes before they reach production.
- A request is sent twice after a timeout. Design requests so a retry does not create a duplicate action.
What Interkey does on a Nafath integration
- Scoping: where Nafath is used, which authentication level, and how identities map to your users.
- Preparation: the technical details your organisation's access request needs.
- Build and test: the integration in your back end or identity layer, including failure paths, against the operator's documentation.
- Go-live: production cut-over with written responsibilities.
- Operation: monitoring, credential renewal and changes from the operator, under a written managed-services scope if you want us to run it.
Interkey's software engineering and system integration team works from Riyadh, in Arabic and English. Nafath is usually one of several national platforms a Saudi system must connect to; our guide to Saudi digital platform integration covers the others.
Questions IT teams ask
Can a private company integrate with Nafath?
Yes. Nafath serves government and private entities. Your organisation requests access from the operator and follows its terms.
Does Interkey give us access to Nafath?
No. Access is granted to your organisation by the platform operator, the National Information Center at SDAIA. Interkey builds and operates your side of the integration.
Has Interkey delivered a Nafath integration before?
Yes. Interkey has delivered a Nafath integration. Client names are shared only with the client's agreement.
Where do we get the Nafath integration documentation?
From the operator, as part of your organisation's access. We build against the version you receive and track updates.
Can Nafath be used for more than sign-in?
Yes. Besides sign-in, services use Nafath to check identity when an account is opened and to confirm sensitive actions, at the authentication level each one needs.
Next
Related pages
Next step
Plan your Nafath integration
Tell us which website, portal or app needs Nafath, what it will be used for, and whether your organisation already has access from the operator. We will reply with the integration steps for your case and what we need from your team.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia