Frequently Asked Questions about CH2A

• CH2A Readiness Application
  
• CH2A Readiness Documentation
  
• CH2A Readiness Support Organization

See also the articles in the "Testing" section of this documentation.

See also the articles in the section «User Guidance – Documentation provided by the business unit/application».

• Why is CH-LOGIN being replaced by AGOV?
  
• Do I have to switch from CH-LOGIN to AGOV-Login immediately?
  
• Should I register an AGOV-Login or a CH-LOGIN?
  
• How can I switch from CH-LOGIN to AGOV-Login?
  
• Where can I find help and information about CH-LOGIN, AGOV, and the migration from CH-LOGIN to AGOV?
  
• What should I do if my CH-LOGIN / AGOV-Login no longer works?
  
• What do I need to do if the application requires a verified (clarified) identity?

• The topic of communication will result in different measures in the context of the various CH2A phases (see details under “Roadmap”).
  
• Communication is carried out in a target-group-oriented manner through a variety of channels.
  
• Communication takes place in close coordination between the communication departments of the FCh/DTI and FOITT.
  

• Important announcements, planning information, and requests are distributed via the Release eIAM mailing list at eIAM-Releases@bit.admin.ch. We will use this channel to communicate whenever we require communication measures from specific stakeholder groups, such as business application managers.
  
• Please send us an email at eIAM-Releases@bit.admin.ch if you would like to be added to the mailing list.
  
• Should you receive questions regarding CH2A, we kindly ask you to refer to our project page containing all relevant information.
  
• If you have any questions or concerns, you can contact us at any time via eIAM-Releases@bit.admin.ch.

• In principle, specialist departments should not create their own user manuals for login via eIAM and/or account registration processes. Reference should always be made to the documentation in the help articles provided, specifically linking directly to the homepage help.eiam.admin.ch.
  
• For the topic of CH2A, text templates for use by the specialist departments are available on the following page: Text templates.
  
• The text templates have already been sent by email to the various communications departments of all offices. They should therefore be informed about the CH2A situation and the use of these text templates in your communication.

Further information on the support processes can be found here

central help page

The 20 support organizations with applications having the highest CH-LOGIN usage are contacted and trained in the use of Halo ITSM. This is the ticket tool into which customer tickets submitted via the help page flow. As part of the triage by the citizen support of FOITT, tickets that the remaining specialist supports should resolve themselves are returned to them via e-mail.

• AGOV-Allow
  Phase completed.

• AGOV-First
  Phase completed.

• AGOV-Push (current phase)
  Start REF 17.03.2026 / ABN 21.04.2026 / 10.05.2026 (Mönch)
  
  • In this phase, CH-LOGIN users are prompted to switch to AGOV at each login. It remains possible to ignore or skip the prompt and continue using CH-LOGIN.
    
  • It will no longer be possible to register new CH-LOGIN accounts. When attempting to register a CH-LOGIN, the user is prompted to register an AGOV login instead.
    
  
  
• AGOV-Force
  Start REF 15.12.2026 / ABN 27.01.2027 / 14.02.2027 (Obergabelhorn)
  
  • In this phase, CH-LOGIN users are forced to upgrade to AGOV-Login.
    
  • CH-LOGIN can no longer be used to log in to eIAM-integrated applications. It can only serve as proof of identity for upgrading to AGOV-Login.
  
  
• AGOV-Only
  Expected launch Q4/2027
  
  • In this phase, CH-LOGIN can no longer be used. Neither for logging into applications nor as proof of a CH-LOGIN identity for upgrading to AGOV-Login. Users who have not upgraded their CH-LOGIN to AGOV-Login by this point will lose their existing authorisations in applications.
    
  • During this phase, CH-LOGIN will be phased out. This also includes the removal of orphaned identities (those not upgraded from CH-LOGIN to AGOV login).

The exception concerns users who require verified identities (QoA higher than QoA30). Verified identities are offered in eIAM, in the eGOV context, exclusively in AGOV starting with AGOV-First. This allows users to benefit from their verified identity also outside the federal administration in interactions with other levels of government.

Recommendation to switch to AGOV

Users can continue using their CH-LOGIN or choose AGOV.

For users who subsequently access eIAM-integrated business applications with an AGOV login, the so-called “CH2A wizard” was developed. It supports users in switching from CH-LOGIN to AGOV login in a simple and secure manner.

In the subsequent phases of CH2A, communication with users will also take place outside the direct runtime use of eIAM. Email will be used as the communication channel so that users who rarely use their CH-LOGIN are also informed.

Different rules and processes apply to cantons and their municipalities. Details on this connection procedure can be found under the following link: (Closed User Group)

• In the current “AGOV-Push” phase, no application adaptations should be necessary anymore. Any required adaptations were most likely already completed during the “AGOV-First” phase.

• New application integrations into eIAM are already being implemented based on the new conditions.
  
• As part of the integration, it is important that applications are specifically tested for the use case “User switches from CH-LOGIN to AGOV login”. See also the “Testing” section.
  
• It is very important that any issues related to switching from CH-LOGIN to AGOV are identified already in the REFERENCE environment. This allows us to jointly avoid problems for your business application and its users during the subsequent integration work and the rollout to ACCEPTANCE and PRODUCTION.

However, there are certain adjustments to the claims due to the adaptation of the technical integration of AGOV and the other BYOI identity providers (Switch eduID, #edaLogin, GenèveID, ZUGLOGIN, and eZug) as standalone identity providers. All identity providers are no longer connected indirectly via CH-LOGIN, but are now integrated directly. As a result, there is no longer any linkage with a CH-LOGIN, which means that CH-LOGIN-specific claims are removed and identity-provider-specific claims now contain the correct values.

Please refer to the list below for the detailed changes to the respective claims:
AGOV-First backward compatibility of delivered claims

An overview can be found on the page Backward compatibility of the delivered claims. The claims marked in red will no longer be provided with the introduction of AGOV-First

Ordering vouchers

Important: CH-LOGINs that have already been verified, either via CH-LOGIN video identification (nHEC+) or through the VASCO token issuance process, retain their verification status until the end of the AGOV-Force phase (end-of-life of CH-LOGIN). This remains valid even if they use a non-verified AGOV login. Only from that point onward is a new verification in AGOV required.

Scenario 1: The user calls up an application with a QoA requirement higher than QoA30. The user logs in with an unverified AGOV-Login. eIAM recognises that the QoA requirement is not met. eIAM informs the user that they need a higher quality AGOV-Login and provides them with a help page where they can find all the information they need to improve their AGOV-Login to the required quality.

Scenario 2: The user calls up an application with a QoA requirement higher than QoA30. The user logs in with a CH-LOGIN that does not meet the required identity quality. CH-LOGIN recognises that the QoA requirement is not met. CH-LOGIN informs the user that they need an AGOV-Login with a higher quality and provides them with a help page where they can find all the information they need on how to register and verify an AGOV-Login with the required quality.

Scenario 3: The user calls up an application with a QoA requirement higher than QoA30. The user attempts to register a CH-LOGIN. CH-LOGIN explains to the user that new, verified identities are only supported with AGOV-Login. CH-LOGIN informs the user that they need an AGOV-Login with increased quality and provides them with a help page where they can find all the information they need on how to register and verify an AGOV-Login with the required quality.

Scenario 4: The department informs the user directly during the onboarding process that they need a verified AGOV-Login to access the application. The department provides the user with the necessary information during the onboarding process. This information includes the URL of the help page and, if necessary, a voucher code for video identification in AGOV at the organisation's expense.

The identification process is subject to a fee and must be paid by the user before starting the identification procedure. In addition to other online payment methods, vouchers procured by the administrative unit and handed over to the user are also accepted. Details regarding voucher orders for administrative units can be found here: Ordering vouchers

We always recommend creating a generic test account. We have had good experience with Gmail, because there is a feature that allows the use of mail extensions with a "+" (plus sign) and merges them into a single mailbox. This allows me to manage several accounts via a central mailbox. For example, it can look like this:

• Main account on Gmail: example.test@gmail.com
  
• AGOV or CH-LOGIN test account 1: example.test+001@gmail.com
  
• AGOV or CH-LOGIN test account 2: example.test+002@gmail.com
  

For AGOV testing, we recommend the following setup:

• Creation of 2 AGOV accounts
  • example.test+001@gmail.com
    
  • example.test+002@gmail.com
• Creation of 2 CH-LOGIN accounts
  • example.test+001@gmail.com
    
  • example.test+003@gmail.com
• This way, with the first AGOV - CH-LOGIN pair the use case of the same email address can be tested, and with the second pair the use case of different email addresses can be tested.

Important: When testing from the federal network, do not forget to disable Autologon via the cookie page

1. Test case: Log in to your application via all identity providers currently used by the specialist application with the appropriate test user for regression testing.
   
   • CH-LOGIN
     
   • FED-LOGIN
     
   • BYOI identity providers (e.g. #edaLogin, Switch edu-ID, ZUGLOGIN, eZug, Genèv eID)
     
   • Identity provider sector (e.g. V-Login, HIN, PTI, etc.)
     
   • Specialist community login (FEDRO, FOEN, FOCBS or FOC)
     
   • Expected behaviour: The user is still recognised in the application as the user known from the past (before the release was introduced) (ID, roles, data, documents remain unchanged).
   
   
2. Test case: Existing user of the specialist application continues to use it with CH-LOGIN
   
   • User has already used the specialist application in the past with a CH-LOGIN identity
     
   • User accesses the specialist application.
     
   • User uses the login function of the specialist application (if interactive).
     
   • Select CH-LOGIN.
     
   • Login with CH-LOGIN.
     
   • Expected behaviour: The user is still recognised in the application as the user known from the past (before the release was introduced) (ID, roles, data, documents remain unchanged).
   
   
3. Test case: Existing user of the specialist application uses their AGOV-Login for the first time in eIAM – identical email address
   
   • The user has already used the specialist application in the past with a CH-LOGIN identity.
     
   • The user calls up the specialist application.
     
   • The user uses the login function of the specialist application (if interactive).
     
   • User selects AGOV.
     
   • User authenticates in AGOV with an AGOV-Login with the same email address as their CH-LOGIN. Or user registers a new AGOV-Login in AGOV with the same email address as their CH-LOGIN.
     
   • User is guided through the upgrade process by the CH2A wizard.
     
   • It is determined that a CH-LOGIN exists that was registered with the same email address as the AGOV-Login.
     
   • The user is prompted to upgrade from CH-LOGIN to AGOV-Login. To do this, they are prompted to log in with their CH-LOGIN password (and second factor, if applicable).
     
   • If the CH-LOGIN credentials are entered correctly, the upgrade to AGOV-Login is performed.
     
   • Expected behaviour: The user is still recognised in the application as the user known from the past (before the release was introduced) (ID, roles, data, documents remain unchanged).
   
   
4. Test case: Existing user of the specialist application uses their AGOV-Login for the first time in eIAM - Different email address
   
   • The user has already used the specialist application in the past with a CH-LOGIN identity.
     
   • The user calls up the specialist application.
     
   • The user uses the login function of the specialist application (if interactive).
     
   • User selects AGOV.
     
   • User authenticates in AGOV with an AGOV-Login with a different email address than their CH-LOGIN. Or user registers a new AGOV-Login in AGOV with a different email address than their CH-LOGIN. The AGOV-Login has not yet been used in eIAM.
     
   • The user is guided through the upgrade process by the CH2A wizard.
     
   • It is determined that no CH-LOGIN exists that was registered with the same email address as the AGOV-Login. The user is asked whether they have a CH-LOGIN that is registered with a different email address.
     
   • The user confirms that they have a CH-LOGIN.
     
   • The user is prompted to enter their email address, password (and second factor, if necessary).
     
   • If the CH-LOGIN credentials are entered correctly, the upgrade to AGOV-Login is performed.
     
   • Expected behaviour: The user is still recognised in the application as the user known from the past (before the release was introduced) (ID, roles, data, documents remain unchanged).
   
   
5. Test case: New user of the specialist application uses their AGOV-Login for the first time in eIAM
   
   • The user has never used the specialist application or eIAM in the past (not even with CH-LOGIN).
     
   • The user calls up the specialist application.
     
   • The user uses the login function of the specialist application (if interactive).
     
   • The user selects AGOV.
     
   • The user authenticates themselves in AGOV with an AGOV-Login. Or the user registers a new AGOV-Login in AGOV.
     
   • The user is guided through the upgrade process by the CH2A wizard.
     
   • It is determined that no CH-LOGIN exists that was registered with the same email address as the AGOV-Login. The user is asked whether they have a CH-LOGIN that is registered with a different email address.
     
   • The user confirms that they do not have any CH-LOGIN.
     
   • A new account is created for the user in eIAM.
     
   • Expected behaviour: The onboarding of the new user in the line application (and in eIAM, if access management is in eIAM) works as specified by you for the line application.

In such cases, for example, the user may no longer see data they had entered using CH-LOGIN after switching to AGOV-Login, or they may no longer see documents they had uploaded with their CH-LOGIN.

• If the test case allows the use of non-verified identities, an AGOV-Login can be registered in AGOV. Up to 10 Access Apps can be registered on this AGOV-Login on different smartphones. Alternatively, multiple security keys can be registered for the AGOV-Login.
  
• If the test case requires the use of verified identities, only personal, non-transferable, verified identities may be used. Technically, it is still possible to pass on this personal identity to other individuals. However, this is strongly discouraged. The owner of this verified personal identity is responsible and liable for its use.

The User-Agent can set an HTTP request header for HTTP requests to the BTB (feds-r.eiam.admin.ch / feds-a.eiam.admin.ch / feds.eiam.admin.ch):

• X-MOS-Agent: Automation
  

Background

One possible factor is notifications to users, for example information about upcoming maintenance work or other service disruptions affecting eIAM or applications integrated with eIAM. A human user reads the information, acknowledges it, and then continues the login process. An automated process, however, is usually unable to handle such a situation. As a result, the change in the expected flow often causes an error because the automated process does not anticipate this additional step.

In particular, as part of the replacement of CH-LOGIN with AGOV, an «Intermediate Page» is displayed after selecting CH-LOGIN starting from the «AGOV-Push» phase and later during the «AGOV-Force» phase - beginning with the eIAM release «Mönch». This page informs users about the transition to AGOV, encourages them to migrate and, in the «AGOV-Force» phase, requires them to switch from CH-LOGIN to AGOV.

With the solution documented here, this page can be skipped, allowing a direct redirect to CH-LOGIN.

See the documentation here:

• Registration of new CH-LOGIN identities
  
• Login with CH-LOGIN identities
  
• Recovery of CH-LOGIN identities (e.g. password reset)
  
• Switch from CH-LOGIN to AGOV login
  
• Verification/validation of identities (higher QoA)

• In principle, specialist departments should not create their own user manuals for login via eIAM and/or account registration processes. Reference should always be made to the documentation in the help articles provided, specifically linking directly to the homepage help.eiam.admin.ch.
  
• For the topic of CH2A, text templates for use by the specialist departments are available on the following page: Text templates.
  
• The text templates have already been sent by email to the various communications departments of all offices. They should therefore be informed about the CH2A situation and the use of these text templates in your communication.

It is no longer possible to register new CH-LOGINs. When a user attempts to register a CH-LOGIN, they are prompted to register an AGOV login instead.

• When the user accesses a web application of the Federal Administration that is integrated with eIAM and requires a login, they do not select "CH-LOGIN" but instead choose "AGOV" to sign in.
  
• The user logs in to AGOV using an existing AGOV-Login or registers a new AGOV-Login.
  
• Following a successful login or registration in AGOV, the user is automatically guided through the upgrade process by the CH2A-Wizard. Several scenarios are possible:
  
  • a) The user has already used their AGOV-Login during the AGOV-First phase with the Federal Administration.
    
    • The CH2A-Wizard detects that this AGOV-Login is already known and that no upgrade from CH-LOGIN to AGOV-Login is necessary. The user is forwarded directly to the application.
  • b) The user is using their AGOV-Login for the first time with the Federal Administration. They registered their AGOV-Login with the same email address as their
    CH-LOGIN.
    
    • The CH2A-Wizard detects via the email address provided by AGOV that a
      CH-LOGIN with the same email address exists.
      
    • The user is prompted to log in one last time with their CH-LOGIN. This ensures that only the legitimate owner of the CH-LOGIN can link it to the AGOV-Login.
      
    • After a successful login with CH-LOGIN, the user’s eIAM account is linked to their AGOV-Login.
      
    • The user is informed that their CH-LOGIN has been deleted, that it can no longer be used, and that they must now use AGOV to log in.
      
    • From now on, the user can log in securely and conveniently using their AGOV-Login. All their permissions have been transferred to their AGOV-Login.
  • c) The user has already used their AGOV-Login in the context of AGOV-Allow within the Federal Administration. The user used the AGOV-Login as a "BYOI" identity with CH-LOGIN.
    
    • In this case, the AGOV-Login is already linked to the user's CH-LOGIN.
      
    • The user is informed that their CH-LOGIN has been deleted, that it can no longer be used, and that they must now use AGOV to log in.
      
    • From now on, the user can log in securely and conveniently using their AGOV-Login. All their permissions have been transferred to their AGOV-Login.
  • d) The user is using their AGOV-Login for the first time with the Federal Administration. They registered their AGOV-Login with a different email address than their
    CH-LOGIN.
    
    • The CH2A-Wizard detects via the email address provided by AGOV that no
      CH-LOGIN with this email address exists.
      
    • The user is asked whether they have a CH-LOGIN registered under a different email address than their AGOV-Login and whether they wish to replace that CH-LOGIN with their AGOV-Login.
      
    • If the user confirms they have a CH-LOGIN, they are prompted to log in with it to prove they are the rightful owner of that CH-LOGIN account.
      
    • After successful login with their CH-LOGIN, the user's eIAM account is linked to their AGOV-Login.
      
    • The user is informed that their CH-LOGIN has been deleted, that it can no longer be used, and that they must now use AGOV to log in.
      
    • From now on, the user can log in securely and conveniently using their AGOV-Login. All their permissions have been transferred to their AGOV-Login.
  • e) The user is using their AGOV-Login for the first time with the Federal Administration. The user does not have a CH-LOGIN.
    
    • The CH2A-Wizard detects via the email address provided by AGOV that no
      CH-LOGIN with this email address exists.
      
    • The user is asked whether they have a CH-LOGIN registered under a different email address than their AGOV-Login and whether they wish to replace that
      CH-LOGIN with their AGOV-Login.
      
    • The user selects that they do not have a CH-LOGIN they wish to link with this AGOV-Login.
      
    • For security reasons, the user must confirm that they really do not want to link a CH-LOGIN with their AGOV-Login. They are informed that a connection to a
      CH-LOGIN will no longer be possible later.
      
    • From now on, the user can log in securely and conveniently using their AGOV-Login. No permissions have been transferred because the user has not yet used any Federal Administration applications with CH-LOGIN.

help.eiam.admin.ch

Through the context-based user guidance of the new eIAM help page, developed by a UX specialist, users can access various help articles on help.agov.ch. In addition to the help articles, the AGOV help page also provides tips and tricks in the form of AGOV explanatory videos.