1.4 KiB
name, description
| name | description |
|---|---|
| sudloh-oidc | Integrate a Sudloh application or API with account.sudloh.com's OIDC sign-in and token validation. Use for guide.sudloh.com, buzz.sudloh.com, or another registered Sudloh client. |
Sudloh OIDC integration
Read references/api.md before implementing a client or protected API. It defines the issuer, endpoints, security checks, credentials, examples, and sign-out behavior. Treat OIDC discovery as the current source of endpoint URLs at runtime.
For any project, determine its exact HTTPS callback URL first. A verified Sudloh Account administrator can sign in at https://account.sudloh.com/account, open OIDC clients, and create a client with a project name and that callback URL. Copy the new client_id and client_secret from the result immediately; the secret is shown only at creation. Give them only to that project's server and register a separate client for each project. The command line client:register script remains available for Guide and Buzz operators. Each app owns its own session. Do not send a browser's account service cookie to an app API or treat an ID token as an API access token.
For Guide profile syncing and revocation checks, use the account settings URL, UserInfo, and authenticated introspection contract in references/api.md. The current openid profile email grant has no refresh token, so reauthorize when its access token expires.