I would like to create a site for kids in which only the kids can see the information. The site should be accessible only to users under the age of 12.

I'm not interested in tracking users and would like to guarantee as much anonymity as possible.

Can I create an SIOPv2 login process in which the server can not correlate a repeat login?

  • Can you please specify that you want to use KILT? Otherwise the Q is missing context. Aug 22, 2023 at 13:31

1 Answer 1


Unfortunately what you are trying to do is authorization, while SIOPv2 deals with authentication. Hence, revealing the sub identifier is a required step in the SIOPv2 flow. You could look at OAuth as a way to perform user authorization, without revealing the subject of the user (but simply via bearer tokens).

Mind that the Identity Provider still has access to the user identity, but the website (called relying party) does not need to have access to that information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.