UAE PASS integration guide: login UX, API and consent

The government portal u.ae describes UAE PASS as the national digital identity and signature app, built by Digital Dubai, the Telecommunications and Digital Government Regulatory Authority (TDRA) and Abu Dhabi's Department of Government Enablement. It gives apps authentication, digital signatures and, for private organisations, document sharing.

Reach is not the problem. TDRA reported 4.6 million users in 2022 and 7.2 million in 2023, then more than 11 million in September 2025, with more than 15,000 services from over 350 entities. Digital Dubai reported more than 12 million registered users on 21 July 2026.

Two figures disagree: TDRA's December 2023 report gave 6.84 million, and a Digital Dubai post on 28 July 2026 said over 14 million. I chart the conservative registered figure.

Not everyone has it. Visitors can register with a passport or GCC ID, but many overseas buyers will not, and the FAQ asks providers to offer service centres or representatives for elderly users and minors. Private providers also need a valid UAE trade licence, and UAE PASS says not to use it for a narrow job, such as only updating an email address.

The documented web flow:

1. The user taps the official button. UAE PASS wants the user, not your app, to start authentication.
2. You redirect with your client ID, scope, a state value against request forgery and ui_locales (en or ar), so the UAE PASS page matches your language.
3. The user enters an email, mobile number or Emirates ID, then confirms a push notification in the UAE PASS app.
4. The browser returns with a code. Your server exchanges it within 10 seconds and fetches the profile. The access token lasts 3,600 seconds for every provider.
5. When the user signs out of your site, sign them out of UAE PASS too.

The waiting screen belongs to UAE PASS; your design starts at the return, and your app needs its own session.

In a mobile app, first check whether UAE PASS is installed. If it is, start the flow in an embedded WebView, catch the UAE PASS deep link, swap its return addresses for your own app's scheme and open UAE PASS, which calls your app back when the user confirms. If not, the user types an identifier and approves on another device.

One tension: UAE PASS requires the embedded WebView, while the IETF's guidance for native apps (RFC 8252) says apps must not use embedded browsers for authorisation, so raise it with the onboarding team early. Then design four states of your own: the handoff to UAE PASS, a return without a result, not installed, and the result.

UAE PASS calls its levels Strength of Profile (SOP), and the userType attribute carries the level of assurance.

Visitors arrive as SOP1 or SOP3, and verified visitors carry a visitor profileType and a unifiedId. No visitor gets an Emirates ID number. No public document maps SOP levels to an outside framework such as NIST's.

Display first and last names, not the full-name field, which uses commas as separators in the documented samples. Residents' Arabic names arrive only with verified accounts, so an Arabic interface needs an English-name fallback, isolated for right-to-left text as in my Arabic RTL design guide. Set a minimum level per service, but if unverified users get basic services through your own login, SOP1 users must get the same.

UAE PASS's implementation guidelines mostly cover what happens next:

• Link on the UUID or a verified Emirates ID. Users can change their email and mobile in UAE PASS, which orphans links built on them, and UAE PASS advises against email-only linking. Store the UUID and use it for every later sign-in.
• Never link a verified local account to SOP1, or an unverified local account to SOP2 or SOP3.
• Only verified attributes count: an Emirates ID checked through the ICP validation gateway or by an agent, or an email or mobile confirmed by one-time code. Typed values do not.

The guidelines define four manual cases. Case A: two local records share an identifier, so the user picks one. Case B: a match is found, so the user signs in once with existing credentials. Case C: nothing matches, so one page offers linking or sign-up. Case D: no identifier, so you ask whether they already have an account.

For new sign-ups, prefill your form from UAE PASS and lock those fields, in the form and the profile. Ask only for business fields and never for a password. Extra checks, such as one-time codes or liveness, come after UAE PASS authentication. UAE PASS lists seven standard use cases, from UC 1.1.1 (existing users, automatic linking only) to UC 1.3.1 (new sign-ups only); pick one before you design. For company or family accounts, ask after sign-in who the user is acting for.

Use the official button assets: white on dark backgrounds, outlined or black on light ones, at least 140 by 30 points. Do not show "Sign in" and "Sign up" buttons on one page, do not mix "Sign in" with "Login", capitalise only the first word and keep "UAE PASS" in capitals. A "What is UAE PASS?" link may sit 10px below the button, and "Powered by UAE PASS" needs written consent.

The patterns behind the official copy:

• Sign-up titles must say the user is signing up to your service with UAE PASS, not creating a UAE PASS account.
• "Continue with UAE PASS" must say documents are being shared for identity verification, and should explain how to upgrade an account.
• Error messages are short and plain. Where access is refused, they give the reason in the user's terms and name your organisation as the contact.
• Arabic versions exist for every documented message and button. Several call UAE PASS الهوية الرقمية, "the digital identity", so use the official assets rather than translating.
• Data-sharing requests have English and Arabic purpose fields, so write both.

Have a native Arabic speaker review the strings you write yourself.

Design every row in both languages.

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data took effect on 2 January 2022. Article 2 excludes government data and entities, health and banking data with their own laws, and free zones with their own data protection law.

On screen, it means:

• Consent is the default unless an Article 4 exception applies, such as performing a contract. Sign-in data may rest on the contract; marketing needs consent. Your lawyer decides the basis.
• Consent must be provable, clear and simple, with an easy way to withdraw (Article 6). Log each consent's version and time, and put withdrawal in settings.
• Before processing, tell users the purposes, who data is shared with inside and outside the UAE, and the cross-border safeguards (Article 13(2)).
• Users can object to direct marketing (Article 17) and to automated decisions, including profiling, with human review on request (Article 18).

Article 28 required Executive Regulations within six months, and Article 26 leaves penalties to a Cabinet decision. Neither was listed on the legislation portal page archived on 27 August 2026, and a Chambers guide from March 2026 said the regulations were still to come. Firms then get six months to comply (Article 29), so design to the law now.

DIFC law covers companies incorporated in DIFC wherever they process data, and others processing in DIFC as part of stable arrangements (Article 6). It also asks firms to check consent stays valid and to seek re-affirmation when users would no longer expect processing (Article 12), and since July 2025 individuals can claim compensation directly in the DIFC Courts (Article 64A).

ADGM's regulations cover processing in the context of an ADGM establishment (section 3); a transition for Al Reem Island ended on 31 December 2024.

For firms licensed by the Central Bank of the UAE (CBUAE), two rulebook documents matter most:

• Digital identification guidance (in force since 31 October 2022) tells firms to verify Emirates IDs through the ICP validation gateway, the UAE PASS app or another government solution, and keep the ID copy and verification record. Remote onboarding through a reliable digital ID can be standard risk, but each firm must assess its assurance levels.
• Consumer Protection Standards (Notice 1158/2021) require more than one evidence of identity online, written disclosure of data use and sharing before consent, explicit consent with the right to refuse, marketing consent recorded and kept for five years, withdrawal within 30 calendar days, and all disclosures in Arabic and English.

The CBUAE's own law was replaced by Federal Decree-Law No. 6 of 2025 on 16 September 2025, with existing regulations kept until replaced. In April 2026 it launched a unified e-KYC platform with Norbloc; how customers will see it is not public.

A sign-up that reflects these rules, in order: a bilingual disclosure screen, UAE PASS sign-up requiring SOP2 or SOP3, a locked prefilled profile, a second check, an unticked marketing consent, then the contract. Screening and risk rating stay your job. My Nafath sign-in guide covers the Saudi equivalent, and my UAE product design page shows how I scope these journeys.

1. Pick the use case from what your database holds: verified Emirates IDs, unverified accounts or nobody yet.
2. Set the minimum level for each service and note it in the use case diagram you submit.
3. Draw sign-in and sign-up as separate pages, with UAE PASS apart from your own login.
4. Design automatic linking, Cases A to D and new sign-up for one release.
5. Add disclosure and consent screens for the law that applies, in both languages.
6. Design every error and return state in the table above.
7. Build web and mobile, including the not-installed branch.
8. Test in staging with SOP1, SOP3 and visitor accounts; upgrades happen on the staging self-care portal, as face verification does not work in the staging app.
9. Record every scenario on video for the assessment; UAE PASS checks production again at go-live.

• Merging UAE PASS into the password form, or triggering it automatically.
• Relying on email or mobile for later sign-ins, which breaks when users change them.
• Asking new UAE PASS users for a password, or letting them edit prefilled fields.
• Leaving out ui_locales, so Arabic users land on an English page.
• Testing only SOP3 accounts, or giving people without UAE PASS no way in.

Can a private company integrate UAE PASS?

Yes. Private organisations can use authentication, digital signature and document sharing. You request access through the UAE PASS developer portal, provide a valid UAE trade licence, submit questionnaires and a use case diagram, and sign a service provider agreement. The onboarding team then assesses your staging build before issuing production credentials.

How much does UAE PASS integration cost?

The UAE PASS developer FAQ says there are currently no charges for integrating, but the same answer mentions a review in 2021, so confirm with the onboarding team. Your real costs are design, development, testing and the assessment: linking, errors and consent in two languages take more time than the button suggests.

What is the difference between SOP1, SOP2 and SOP3?

They are UAE PASS account levels. SOP1 is basic: email and mobile are verified, the Emirates ID is not. SOP2 is advanced: the Emirates ID is verified and the user can sign documents. SOP3 is qualified: verified with fingerprint or face biometrics, it allows qualified signatures and document sharing. Set a minimum level per service.

Can UAE PASS replace eKYC for a bank or fintech?

Partly. CBUAE guidance names the UAE PASS app as one way to verify an Emirates ID during onboarding, and allows remote onboarding through reliable digital identity. You must still assess its assurance level, keep verification records, add a second evidence of identity for online services and run your own screening and risk rating.

Does the PDPL apply to my app, or the DIFC or ADGM law?

It depends where you are licensed. Mainland companies, and free zones without their own data law, fall under the federal PDPL. DIFC companies follow DIFC Law No. 5 of 2020, and ADGM establishments, including those on Al Reem Island, follow the ADGM Data Protection Regulations 2021. Banking and health data can have their own rules, so ask your lawyer.

Can tourists or people abroad sign in with UAE PASS?

Visitors can register a UAE PASS account with a passport or GCC ID, and verified visitor profiles are marked as such. Many overseas customers, such as property buyers who have never visited, will not have one. If they matter to you, keep a second sign-in route and a document-based identity check.

Start from the linking cases, not the button. Choose your use case and minimum level, design linking, sign-up, consent and every error state in both languages, then build. Keep a second route for people without UAE PASS.

My team designs these journeys remotely from Dhaka, sharing Monday to Thursday of the UAE week; read more about me and my product design work. A project starts with a free 30 minute intro call, then a written scope and one fixed quote, with no retainer. Planning a UAE launch? See how I work as a product designer in Dubai's working hours.

I read every source on 4 October 2026. Fines are in US dollars as written, so no conversion was needed. The UAE legislation portal blocked my connection, so I read the official English PDPL and its portal page through Internet Archive copies. Data is thin in three places: user counts differ between sources, no push timeout is published, and no public mapping links SOP levels to an outside framework.

• UAE PASS, developer documentation (version 7.2, 7 June 2026): docs.uaepass.ae, docs.uaepass.ae, docs.uaepass.ae
• u.ae, the UAE PASS app (30 December 2024) and data protection laws (4 December 2025): u.ae, u.ae
• TDRA, Digital Enablers Report 2023 (18 December 2023) and digital achievements (13 September 2025): tdra.gov.ae, tdra.gov.ae
• Aletihad, TDRA Director-General on UAE PASS users, 19 February 2024: en.aletihad.ae
• Digital Dubai, news release (21 July 2026) and post on X (28 July 2026): digitaldubai.ae, x.com
• Federal Decree-Law No. 45 of 2021, official English translation (archived August 2024) and portal page (archived 27 August 2026): uaelegislation.gov.ae, web.archive.org
• Chambers, Data Protection and Privacy 2026, UAE trends, 10 March 2026: practiceguides.chambers.com
• DIFC, Data Protection Law No. 5 of 2020, consolidated July 2025: difc.com
• ADGM, Data Protection Regulations 2021, consolidated February 2024: en.adgm.thomsonreuters.com
• CBUAE Rulebook, digital identification guidance and Consumer Protection Standards, Articles 2 and 6: rulebook.centralbank.ae, rulebook.centralbank.ae, rulebook.centralbank.ae
• Gibson Dunn, new UAE Central Bank law, 2025: gibsondunn.com
• The Paypers, CBUAE e-KYC platform, 17 April 2026: thepaypers.com
• IETF, RFC 8252, OAuth 2.0 for Native Apps, October 2017: rfc-editor.org