What Does It Cost to Integrate BankID?

BankID is the obvious identification method for Swedish digital services – and therefore one of the most requested integrations. The technology is well documented, but the cost picture consists of more than API calls: agreements, transaction costs, and a handful of classic pitfalls. Here’s the full picture.

The pricing picture: SEK 80,000–250,000 including testing

Implementing a BankID integration typically costs SEK 80,000–250,000, including testing and certification against the vendor’s requirements. Where you land in that range is decided by the number of flows and platforms.

The range starting relatively low is because the basic flow is standardized. It ending higher is because of everything around it: session handling, device switching, error cases, and integration with your existing account model.

The agreement: bank or reseller

BankID requires an agreement, and there are two routes:

• Directly with a bank. Suits services with large volumes. More administration and a longer runway to get started, but a lower per-unit price at high volumes.
• Through a reseller. A vendor that already has the bank agreement and exposes BankID through its own API, often alongside other e-IDs. Faster to get going and simpler administration, in exchange for a fixed monthly fee and a somewhat higher transaction price.

The transaction cost – the price per identification or signature – depends on the agreement and volume, typically from under one krona to a few kronor per transaction. For a service where users log in often, the ongoing cost eventually exceeds the implementation cost, so calculate the annual volume before choosing a route.

The pitfalls that drive up cost

Three things surprise almost everyone building their first BankID integration:

1. The test environment. BankID’s test environment requires its own configuration with test certificates and special test BankIDs. It’s not difficult, but it’s a step that needs to be planned for – otherwise development stalls while waiting for working tests.
2. Session handling. What happens when the user switches to the BankID app and back? How long should a started flow stay alive, and how is the successful identification securely tied to the right session? This is where the real security lives – and most audit findings.
3. The flows between mobile and desktop. If the user is at the computer with BankID on their phone, the QR flow is needed; if they’re on mobile, the BankID app should launch automatically and hand the user back to the right place afterward. The device switching is where most bugs live and where testing effort should go.

Worked example: login and contract signing

A service needs BankID for both login and contract signing, on web and mobile. Implementation takes three to four weeks and testing another one to two – a total of roughly SEK 150,000–200,000. On top of that, a reseller agreement with a monthly fee and a per-transaction price. At 5,000 identifications and 500 signatures per month, the ongoing cost is on the order of a few thousand kronor a month – affordable, but a line item that should be in the budget from the start.

How to keep the cost down

• Go through a reseller if volume is moderate. Ready-made APIs and test flows shorten the implementation, and you can switch to a direct agreement later if volume grows.
• Define the flows before development starts. Login, signing, mobile, desktop, device switching – every flow added afterward costs more than the same flow planned from the start.
• Reuse your login architecture. BankID should be one identification method within a well-thought-out session solution, not a special path on the side. That makes the next method – and the next security review – cheaper.
• Test the device switching early. That’s where the bugs live; finding them in week two is cheap, in production expensive.

After launch

BankID keeps evolving – security requirements get tightened and flows get updated, as when the animated QR flow was introduced. Budget a small annual line item to keep the integration in step with the requirements, so you avoid panic updates on short notice.

At Weapp we build this kind of identification flow as part of our integration and app development. Want to know what it would cost in your service? Get in touch.