Gerege Platform

Production · Layer 3 — Platform foundation · Repo: gerege-platform-mn · gerege.mn

The flagship platform of the private-sector line. It inherits everything the Template Platform offers and adds the ability to act as an OIDC identity provider in its own right.

The platform foundation now has two generations

In 2026-08 the 2nd generation arrived: Gerege Nexus, a modular monolith with an app store. Gerege Platform is a 1st-generation product branched from the Template Platform and remains in production on gerege.mn. See Layered architecture for how the two relate.

How it differs from the Template

	Template Platform	Gerege Platform
Role	A foundation for starting new services	A running product
OIDC provider	Optional	Active — RPs sign in through it
Domain	open.gerege.mn (a reference deployment)	gerege.mn (a live service)
Scope	General-purpose	The full citizen-services surface

OIDC provider mode

Gerege Platform can act as an identity provider itself. The in-house OAuth2/OIDC implementation inside the Go backend (usecases/oidc):

• serves /oauth2/*, /userinfo and the .well-known documents,
• drives the login / consent / logout flows,
• lets relying parties offer Sign in with Gerege Platform.

Supported: authorization code + PKCE (S256), rotating refresh tokens (with reuse detection), client_credentials. Access tokens are opaque; id_token is RS256.

It activates as soon as the OAUTH_ISSUER setting is provided.

Gerege Platform vs Gerege SSO

Both can act as an OIDC provider. The difference is purpose. Gerege SSO is a dedicated layer built for authentication alone — used by ecosystem applications and third-party RPs. The IdP mode of Gerege Platform is aimed at the services built on that platform itself. If you are starting a new integration, choose Gerege SSO.

Main capabilities

Everything inherited from the Template (eID + Google authentication, RBAC, organisations, RLS, audit log, API gateway, AI pipeline, the security baseline), plus:

eID PKI profile

Reads and presents the eID identity of the signed-in citizen from the IdP:

• affiliated organisations and authorised signatories,
• certificates,
• registered devices,
• activity history.

Citizen-services surface

A Public services section — service catalogue, requests, lookups, notifications, payments, appointments.

Document signing

Server-side PAdES signatures on PDF (via G-Sign), with a long-lived Document-Signer certificate. Sign-relay lets third-party RPs have documents signed through the platform's own eID credentials.

Third-party integrations

Per-user OAuth connections (Google Drive/Meet, Dropbox) — tokens are stored encrypted with AES-256-GCM. Plus the app's own SFTP storage.

Site appearance

Admin-configurable, site-wide appearance (accent / font / density / theme) for the public pages, with per-user overrides on top.

Structure

gerege-platform-mn/
├── backend/     # Go · chi · pgx · PostgreSQL · Redis · eID/Google/SSO auth
│   └── docs/    # ARCHITECTURE · DEVELOPMENT · API_CONTRACT · SECURITY (EN/MN)
├── frontend/    # Next.js BFF
├── ios/         # SwiftUI eID/Smart-ID client
└── android/     # Kotlin/Compose client

Full documentation

The ARCHITECTURE, DEVELOPMENT, API_CONTRACT and SECURITY documents live in the backend/docs/ directory of the gerege-platform-mn repository. The README is available in EN · MN · ZH · RU.