Skip to content

Gerege POS

Verified identity and e-signature at the point of sale — eID based · AI enabled

Gerege POS identifies the customer standing at your counter by their national eID and seals contracts, approvals and transactions with a legally valid electronic signature. Whatever happens at the till leaves a trail nobody can repudiate later.

Ownership

This platform is owned by Gerege POS LLC. The source lives in a private repository and is built on the Gerege Systems platform-core foundation.

  • eID + Gerege SSO
    Electronic-ID (eID) based sign-in + an OpenID Connect (built-in Go provider) SSO provider. Apps connect with a single tap.

  • Clean Architecture
    Go (chi · net/http · pgx, no ORM) backend + Next.js 15 BFF frontend. Clear layers, easy to extend.

  • eID Service Proxy
    Registered apps call the SSO's eID services by authorization (proxy) — they never need to hold eID credentials themselves.

  • Admin-managed API Gateway
    Service catalog, per-app authorization, telemetry — all from the admin system.

The ecosystem

The platform is composed of several independent services:

Domain Role
sso.gerege.mn Gerege SSO — OIDC provider + eID Relying Party (holds the eID credentials)
geregepos.mn Example app — a relying party of Gerege SSO (signs in via SSO)

Apps (such as geregepos.mn) sign in through sso.gerege.mn and call the authorized eID services via a proxy. Only the SSO holds the RP credentials that talk to eID Mongolia, so apps are freed from that security burden.

Key capabilities

  • Authentication — eID (QR / App2App / national-ID push) + Google linking + Gerege SSO (OIDC).
  • OIDC provider — built on its own Go code; apps Sign in with Gerege SSO.
  • eID PKI profile — organizations, certificates, devices, activity.
  • Document signing (PAdES) — third-party apps sign through the eID sign relay.
  • eID Service Proxy — personal (eid-proxy) and organization (eid-org-proxy), separately.
  • API Gateway — service catalog, per-app authorization, request telemetry.
  • AI assistant (Gemini) — chat, voice, translation.
  • RBAC & super admin, audit log, security hardening (RLS, CSP, HSTS, CSRF).

The full list of capabilities — with permissions, rate limits and the conditions under which each one turns on — is consolidated on the Capability map.

Where to start?

To connect your app to Gerege SSO, see App integration. To fetch eID data through the proxy, see eID Service Proxy. To see every endpoint at once, see the API reference.