Some implementations may provide a method to have a user authenticated at a point of service. The method includes: accessing, by a target system, a multi-dimensional symbol rendered on a display of a mobile computing device of the user, the multi-dimensional symbol encoding endpoints and actions for the target system to perform in order to request and authenticate an identity of a user; decoding data in the multi-dimensional symbol to retrieve an identity token plus information about the authentication actions and the user's identity system; requesting the corresponding authentication actions of the user's identity system to include specific authentication measures for the user to perform as well as data for the user to release; and performing the authentication actions as requested and encoded in the multi-dimensional symbol such that the physical identity of the user of the mobile computing device is verified and the user consents to release the requested identity information at the point of service.