API version 1.3

Lithuanian eID login and qualified signing, as an API

Add Lithuanian eID authentication and qualified electronic signatures (QES) to your product. Use ATK by physical reader or NFC as the primary method, with Smart-ID and Mobile-ID as optional server-side methods.

Request sandbox access Build the first request Try API in the browser Complete API reference

Native NFC card-tap

The resident taps their eID to an Android phone - no reader, no desktop install. The desktop reader path uses the same Web-eID transport gateways already speak.

Four authentication methods

Offer physical ATK, ATK over NFC, Smart-ID or Mobile-ID through one request and result model. Each provider enables only the methods it needs.

Pay-per-use signing

Successful native ATK and service operations cost €0.07; Smart-ID and Mobile-ID operations cost €0.08. Prices exclude VAT. There are no subscriptions, minimums or fractional-cent adjustments.

How it works

ATK card ceremonies use the provider backend plus a card-driving client:

POST /v1/{auth|sign}/requests (HTTP Basic, your keyId:keySecret)
POST /v1/{auth|sign}/{id}/certificate (client reads the card certificate)
... the card signs the audience-bound challenge, after PIN, on the device ...
POST /v1/{auth|sign}/{id}/complete (raw signature -> verified identity or signed container)

You verify the result yourself: re-derive the challenge from your own audience and the returned nonce, and check the signature against the card certificate. You do not have to trust Tvarka's word. Signing adds PAdES, ASiC-E and ADOC assembly, a qualified timestamp, and an advisory validation axis.

Smart-ID and Mobile-ID are server-side ceremonies. Create a request with method: "smart_id" or method: "mobile_id", show the returned verification code, and poll the same request or consume its signed webhook. Remote signing supports PAdES; ATK remains available for PAdES, ASiC-E, ADOC and raw signing.

Start building

1. Get a sandbox key

Request access. A locked, zero-rated sandbox provider is issued after a short review.

2. Run the quickstart

Create an audience-bound request, inspect the response, and continue with a source SDK or Postman. Start in five minutes.

3. Choose an integration asset

Use the Python or web SDK, import the auth or signing collection, and download the test document.

Public developer resources

Canonical OpenAPI 3.1

A single, channel-ready contract in JSON or YAML, plus an APIs.json 0.19 catalog in JSON or YAML. Specialist auth and signing contracts remain available.

Reference and examples

Rendered complete reference, specialist authentication and signing views, response examples, the complete error catalog, and a same-origin Try API console.

Commercial and lifecycle terms

Read pricing mechanics, compatibility and retention/lifecycle policy before production onboarding.

Verification keys

JWKS - public keys for independently verifying the optional identity assertion JWT. The raw certificate and signature are also returned so you can verify the audience-bound result without relying on the JWT.