13 lines
1.4 KiB
Markdown
13 lines
1.4 KiB
Markdown
---
|
|
name: sudloh-oidc
|
|
description: Integrate a Sudloh application or API with account.sudloh.com's OIDC sign-in and token validation. Use for guide.sudloh.com, buzz.sudloh.com, or another registered Sudloh client.
|
|
---
|
|
|
|
# Sudloh OIDC integration
|
|
|
|
Read [references/api.md](references/api.md) before implementing a client or protected API. It defines the issuer, endpoints, security checks, credentials, examples, and sign-out behavior. Treat OIDC discovery as the current source of endpoint URLs at runtime.
|
|
|
|
For any project, determine its exact HTTPS callback URL first. A verified Sudloh Account administrator can sign in at `https://account.sudloh.com/account`, open **OIDC clients**, and create a client with a project name and that callback URL. Copy the new `client_id` and `client_secret` from the result immediately; the secret is shown only at creation. Give them only to that project's server and register a separate client for each project. The command line `client:register` script remains available for Guide and Buzz operators. Each app owns its own session. Do not send a browser's account service cookie to an app API or treat an ID token as an API access token.
|
|
|
|
For Guide profile syncing and revocation checks, use the account settings URL, UserInfo, and authenticated introspection contract in [references/api.md](references/api.md). The current `openid profile email` grant has no refresh token, so reauthorize when its access token expires.
|