OAuth 2.0 · OpenID Connect

Open platform

An application on another domain can sign in with this brand account using the authorization code flow. Each brand host is a separate account system.

Issuer https://jingweihub.com

Steps

1. Sign in on this page and register the application name and https callback. Save the client_id. Confidential applications also save the client_secret, which is shown once.
2. Send the browser to the authorization endpoint with a PKCE code_challenge.
3. After account sign-in and consent on the brand host, the browser returns to your callback with a one-time code and your original state.
4. Your server exchanges the code, code_verifier and client_secret for an access token, refresh token and id_token.
5. Create the session on your own domain. Read user info with the access token when you need the email. Revoke the token on logout.

Endpoints

Discovery

https://jingweihub.com/.well-known/openid-configuration

Authorize

GET https://jingweihub.com/api/public/oauth/authorize

Token

POST https://jingweihub.com/api/public/oauth/token

UserInfo

GET https://jingweihub.com/api/public/oauth/userinfo

Revoke

POST https://jingweihub.com/api/public/oauth/revoke

JWKS

GET https://jingweihub.com/api/public/oauth/jwks

Authorization parameters

• response_type=code
• client_id
• redirect_uri must exactly match a registered https callback
• scope=openid email openid is required; email adds the email claim
• state
• nonce
• code_challenge = BASE64URL(SHA256(code_verifier))
• code_challenge_method=S256

Token request

Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=...&redirect_uri=...&client_id=...&client_secret=...&code_verifier=...

Public applications omit client_secret. Refresh with grant_type=refresh_token. The id_token is RS256. iss is the issuer above, aud is the client_id, and sub is the user id for this brand.

UserInfo uses Authorization: Bearer. Revocation posts token, client_id and client_secret.