City, Gdańsk Authentication: Accessing Digital Services (2026)

Authentication overview

Authentication for City, Gdańsk's digital services is structured to serve two primary user groups: individual citizens accessing public administration services and developers interacting with open data initiatives. For citizens, the emphasis is on secure, nationally recognized identity verification methods, ensuring compliance with Polish regulations for electronic public services. This typically involves integration with centralized national identity systems rather than direct credential management on the Gdańsk municipal portal itself. The goal is to provide a unified and trusted access point for various public services across different governmental entities in Poland.

For developers and researchers interested in programmatic access to public datasets, the City of Gdańsk, like many municipalities, may offer specific API endpoints. These endpoints are often part of broader open data portals, designed to promote transparency and innovation. Authentication for these interfaces is generally simpler, focusing on API key mechanisms to control access rates and identify usage patterns, rather than verifying individual user identities in the same way citizen services do. The official City of Gdańsk website serves as the central hub for information regarding available services and any associated authentication requirements, directing users to the appropriate national or local platforms for access. More information on citizen services is available on the City of Gdańsk's resident services page.

Supported authentication methods

The City of Gdańsk supports different authentication methods tailored to the type of service being accessed and the user's role. These methods are designed to integrate seamlessly with Poland's national digital infrastructure for public administration.

Citizen Authentication

For citizens accessing personalized services (e.g., submitting applications, checking tax status), the primary authentication methods are:

• ePUAP Profile (Profil Zaufany): This is a free, government-issued digital identity that allows citizens to confirm their identity online when dealing with public administration bodies in Poland. It functions as a secure digital signature and is widely accepted across all levels of government. Users create and confirm their ePUAP profile through various methods, including online banking or in-person at designated points. The ePUAP system relies on PKI (Public Key Infrastructure) principles for secure identity verification, as detailed in Microsoft's documentation on PKI and certificate services.
• MojeID: An electronic identity verification service provided by Polish banks. MojeID allows users to confirm their identity to public and commercial service providers using their existing online banking login credentials. This method leverages strong bank-level authentication mechanisms, often based on OAuth 2.0 or OpenID Connect protocols, to provide a secure and convenient way to access services without creating new accounts. Information on the OAuth 2.0 authorization framework can be found on oauth.net's overview of the protocol.

Developer Authentication (Open Data)

For developers accessing specific open data portals or APIs provided by the City of Gdańsk (where available), authentication typically involves:

• API Keys: A simple token-based authentication method where a unique key is issued to the developer. This key is included in each API request, usually as a query parameter or an HTTP header. API keys are suitable for identifying the calling application rather than an individual user and are commonly used for rate limiting and usage tracking on public data APIs. They offer a lower level of security compared to identity-based methods and should be treated as sensitive credentials.

The table below summarizes the supported authentication methods:

Getting your credentials

The process for obtaining credentials depends on the authentication method required for the specific service you wish to access.

For Citizens (ePUAP Profile / MojeID)

• ePUAP Profile (Profil Zaufany):
  1. Registration: Visit the official ePUAP portal (epuap.gov.pl).
  2. Verification: Confirm your identity. This can be done online through a Polish bank that supports ePUAP integration, or in person at one of the designated confirmation points (e.g., municipal offices, ZUS branches, tax offices). Online bank verification is the most common and fastest method.
  3. Activation: Once verified, your ePUAP Profile is active and can be used to log in to various government services, including those provided by the City of Gdańsk.
• MojeID:
  1. Bank Account: You need an active online banking account with a participating Polish bank.
  2. Service Selection: When accessing a service that supports MojeID, select the MojeID option at the login prompt.
  3. Bank Redirection: You will be redirected to your bank's login page to authenticate using your standard online banking credentials.
  4. Consent: After successful bank authentication, you will be prompted to consent to share your identity data with the service provider (City of Gdańsk, in this context).

For Developers (API Keys)

For access to open data APIs, the process for obtaining API keys is typically as follows:

1. Identify the Open Data Portal: Navigate to the City of Gdańsk's official website and locate any sections dedicated to 'Open Data,' 'Developer Resources,' or 'APIs.' The availability of such portals can vary.
2. Registration/Application: You may need to register an account on the specific open data portal. During registration, you might be asked to provide details about your intended use of the API.
3. Key Generation: Once registered and your application approved (if required), the portal will typically provide an interface to generate your API key. This key is usually a long alphanumeric string.
4. Key Management: Store your API key securely. Some portals allow you to regenerate keys if they are compromised.

It's crucial to consult the specific documentation for the open data API you intend to use, as the exact steps for key generation and management can differ between platforms. Always look for a 'Developers' or 'API' section on the City of Gdańsk homepage.

Authenticated request example

Since direct programmatic access to citizen services using API keys is not generally available, the example below focuses on how an API key might be used to access an open data endpoint, assuming such an endpoint exists and requires this method. For citizen services, authentication occurs through browser redirects to ePUAP or MojeID, not direct API calls.

Example: Open Data API Request with API Key

Let's assume the City of Gdańsk provides an open data API for public transport schedules, and it requires an API key passed as a query parameter. The endpoint might look like https://api.gdansk.pl/v1/transport/schedules.

Request Structure (HTTP GET):

GET /v1/transport/schedules?date=2026-05-29&stop_id=12345&api_key=YOUR_API_KEY_HERE HTTP/1.1
Host: api.gdansk.pl
User-Agent: YourApplication/1.0

Explanation:

• GET /v1/transport/schedules: Specifies the API endpoint for retrieving transport schedules.
• date=2026-05-29: An example query parameter for filtering data by date.
• stop_id=12345: Another example query parameter, specifying a particular transport stop.
• api_key=YOUR_API_KEY_HERE: This is where you would replace YOUR_API_KEY_HERE with the actual API key you obtained from the City of Gdańsk's open data portal. This parameter authenticates your application for access.
• Host: api.gdansk.pl: The domain of the API server.
• User-Agent: YourApplication/1.0: An optional header that identifies your client application, useful for API providers for analytics or debugging.

When executing this request, the API server would validate the provided api_key. If valid, it would return the requested transport schedule data. If the key is missing, invalid, or unauthorized, the server would typically respond with an HTTP 401 Unauthorized or 403 Forbidden status code.

Security best practices

Adhering to security best practices is essential when authenticating with City, Gdańsk's services, whether you are a citizen or a developer. These practices help protect your identity, data, and access credentials.

For Citizens (ePUAP Profile / MojeID)

• Protect Your Credentials: Never share your ePUAP login details, bank login credentials, or any associated passwords with anyone. Treat them as you would your physical ID or bank card.
• Use Strong, Unique Passwords: If your ePUAP profile or bank account relies on a password, ensure it is complex, unique, and not reused across multiple services. Consider using a password manager.
• Enable Multi-Factor Authentication (MFA): Many banks and some ePUAP configurations offer MFA (e.g., SMS codes, authenticator apps). Always enable MFA where available to add an extra layer of security to your accounts.
• Be Wary of Phishing Attempts: Always verify the URL in your browser's address bar before entering any login information for ePUAP or your bank. Ensure it's the official, secure website (look for 'https://' and a padlock icon). Be suspicious of unsolicited emails or messages asking for your credentials.
• Log Out After Use: Always explicitly log out of ePUAP or your bank's website, especially when using a public or shared computer.
• Keep Software Updated: Ensure your operating system, web browser, and antivirus software are always up to date to protect against known vulnerabilities.

For Developers (API Keys)

• Treat API Keys as Sensitive: API keys grant access to data. Do not embed them directly in client-side code (e.g., JavaScript in a browser app) where they can be easily extracted. Instead, use a backend server to make API calls.
• Environment Variables for Keys: Store API keys as environment variables on your server or in secure configuration management systems, not directly in your source code repository (e.g., Git). This prevents accidental exposure.
• Restrict Key Permissions: If the API allows, generate keys with the minimum necessary permissions required for your application's functionality.
• Monitor Usage: Regularly review API usage logs for any unusual activity that might indicate a compromised key.
• Key Rotation: Periodically regenerate your API keys. If an API key is ever compromised, revoke it immediately and generate a new one.
• Secure Communication (HTTPS): Always ensure your application communicates with the API over HTTPS. This encrypts the data in transit, protecting your API key and other sensitive information from eavesdropping. The IETF's RFC 2818 on HTTP Over TLS provides foundational understanding of secure web communication.
• Implement Rate Limiting and Error Handling: Design your application to handle API rate limits gracefully and implement robust error handling to prevent excessive requests or unexpected behavior, which can sometimes be exploited.