I'm not exactly sure of the details, but isn't this similar to DigiD in NL? There too you can "prove your Identity and log in" via the govt app. The server side of the 3rd party has to handle the rest (eg user account information etc.), nothing is shared beyond "this is the guy who's signing in, verified by the govt".