UAE PASS is the UAE's national digital identity, overseen by TDRA. Your app needs it when you must be sure who a user really is, for example contracts, financial services, real estate or services linked to government entities. The login redirects the user to UAE PASS to approve on their phone, then returns them to your app with a verified identity. You cannot simply switch it on: integration requires onboarding as a service provider. Ordinary stores and booking apps are usually better served by phone-number (OTP) login.
- uae pass login integration
- how to integrate uae pass in my app
- uae pass openid connect integration
- do i need uae pass for my app
- uae pass service provider onboarding requirements
What is UAE PASS login, and does your app need it?
UAE PASS login lets people sign in to your app or website with their national digital identity instead of yet another password. UAE PASS is the official identity app overseen by the Telecommunications and Digital Government Regulatory Authority (TDRA), and residents already use it to access many government and private services and to sign documents digitally.
The idea is simple: the user taps “Sign in with UAE PASS”, is sent to UAE PASS, approves on their phone, and comes back to your app with an identity you can trust. But the real question is not “how?” but “do I need it at all?”. Many stores are perfectly served by phone-number login.
A practical rule: if an action in your app carries a legal or financial commitment, or you need to know the person by their official name, UAE PASS is a strong choice. If the user is ordering coffee or booking a car wash, national identity verification is usually friction you do not need.
Ask users for as much verification as the action requires, not as much as you can.
When to choose UAE PASS vs phone or email login
Choose by app type and the trust level you need:
| Login method | Trust level | Best for | Notes |
|---|---|---|---|
| UAE PASS | High: verified national identity | Contracts, real estate, financial services, hiring, government-linked services | Requires official onboarding; residents only |
| Phone number (OTP) | Medium: proves ownership of the number | Stores, bookings, delivery, loyalty | Fast and familiar; protect it against SMS abuse |
| Email and password | Low to medium | Business dashboards and internal tools | Add two-factor checks for sensitive accounts |
| Company login (SSO) | Depends on the company system | Employees inside an organization | Good for internal tools and enterprises |
In many apps the best answer is a mix: everyday login by phone, and UAE PASS requested only at a sensitive step such as signing a tenancy contract or confirming a financing request. You do not lose people on the first screen, and you still get verification where it matters.
How does UAE PASS login work, step by step?
UAE PASS follows standard single sign-on patterns (OAuth 2.0 and OpenID Connect). Knowing the flow helps you review what gets built:
- 1Login button
The user taps the UAE PASS button. Your app sends them to the official authorization page with your app identifier and the requested scopes.
- 2Approval on the phone
The user enters their Emirates ID, email or mobile number, then approves the request in the UAE PASS app.
- 3Return with a short-lived code
UAE PASS sends the user back to your registered redirect URL with a short-lived authorization code.
- 4Code exchange on the server
Your server (never the browser) exchanges the code for an access token using your app's client secret.
- 5Read the user profile
The server requests the permitted user attributes, such as name and contact details, and others depending on account type and what the onboarding approved.
- 6Create the session and link the account
Your app creates a session and links the UAE PASS identity to an existing account or creates a new one.
Note that UAE PASS accounts are not all at the same level: some are basic and others are fully verified. If your action needs a verified identity, check the account level in the returned data and show a clear message to users who need to upgrade, rather than failing silently.
What do you need before integrating UAE PASS?
UAE PASS is not a button you enable from a dashboard in minutes, like Google sign-in. Service providers go through registration and approval, and the details vary with the type of entity and service. Prepare these before you start:
- A legal entity and valid licence in the UAE that shows your activity.
- A clear use case: why you need a verified identity and what service the user gets.
- The list of profile attributes you need, with a reason for each field.
- A published privacy policy in Arabic and English explaining what you collect and how you protect it.
- Redirect URLs for staging and production on your own domain over HTTPS.
- A staging environment where you test the full flow before requesting production credentials.
- A technical contact who follows up on correspondence and feedback during onboarding.
Tip: launch with phone login and run onboarding in parallel, so approval never delays your launch.
How to design a login flow people do not get lost in
Integration is half the story; users must also understand why UAE PASS is requested. Common mistakes:
- A UAE PASS button that ignores the official brand guidelines
- UAE PASS demanded on the first screen for every visitor
- A generic English error when the user cancels
- Two separate accounts for the same person (phone and UAE PASS)
- No explanation of why identity is needed
- A button that follows the official guidelines in both languages
- Verification requested only at the step that needs it
- Arabic and English messages that explain what happened and what to do next
- UAE PASS linked to the existing account after phone confirmation
- One short line: “We need to verify your identity to sign the contract”
On mobile, test both cases: a user with the UAE PASS app on the same device, and a user on a laptop who approves from their phone. And make sure your interface works properly right-to-left; see common Arabic UX mistakes.
What data should you store, and how do you protect it?
National identity data is among the most sensitive data your app will hold. Federal Decree-Law No. 45 of 2021 governs personal data protection at the federal level, while DIFC and ADGM have their own data laws. The general rule: collect the minimum, explain why, and protect what you keep.
| Data | Store it? | How to protect it |
|---|---|---|
| UAE PASS unique identifier | Yes, to link the account | Separate field with a unique index |
| Official name | If you need it for contracts and invoices | Limited read permissions |
| Emirates ID number | Only if the service requires it | Encryption, partial masking in screens, access log |
| Mobile and email | Usually yes | Verify before using for marketing messages |
| Access tokens | No longer than needed | Server only, never written to logs |
Control who on your team can see this data with roles and permissions, and keep a log of who viewed which user profile. For the full picture, read the UAE PDPL checklist.
How to build an app with UAE PASS login on Fanann
On Fanann you describe the app in Arabic or English, and the agent builds the screens, database and login logic, with phone login and roles and permissions ready to go. To connect UAE PASS, add the credentials you receive from the overseeing body as server secrets, and ask the agent to build the flow and test it in staging first.
Build a bilingual web and mobile app (Arabic first, then English) for a real estate brokerage in Dubai. Everyday login by mobile number with an OTP code. Add a “Sign in with UAE PASS” button that appears only at the tenancy contract signing step, using an OpenID Connect flow with the code exchange on the server only, reading the user identifier and official name. Link the UAE PASS identity to the current account after phone confirmation and never create a duplicate account. Store the Emirates ID number encrypted, show it partially masked, and log every view. Create separate settings for staging and production, and clear messages in both languages when the user cancels or the account is not verified. Add an admin dashboard with roles: manager, broker, accountant.
Try it in FanannPre-launch checklist
- You tested the full flow in staging: success, cancel, timeout, unverified account.
- Redirect URLs exactly match what you registered and work on your domain over HTTPS.
- The client secret lives in server secrets and never appears in code or logs.
- Your privacy policy mentions UAE PASS data and why you collect it.
- There is a clear alternative login for people without UAE PASS.
- You ran the general security checklist before opening sign-ups.
Key takeaways
- UAE PASS fits when you need a verified identity, not just a convenient login for a regular store.
- Integration goes through official onboarding: a staging environment first, production credentials after approval.
- Request the minimum identity data and treat the Emirates ID number as sensitive data.
- Design a bilingual login flow with a clear alternative for users without a verified account.
- Launch with phone login and add UAE PASS only to the steps that truly need verification.
Frequently asked questions
Do I need UAE PASS for my app?
How do I integrate UAE PASS in my app?
Can any small store use UAE PASS?
What is the difference between UAE PASS and Nafath?
Does UAE PASS replace the phone number?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “UAE PASS login for your app: when you need it and how it works” https://fanann.com/en/blog/uae-pass-login-integration/ My question: uae pass login integration Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.