Sign in with Vex ID

<script src="https://auth.arioron.com/static/js/vexid-sdk.js"></script>
<button id="signin">Sign in with Vex ID</button>
<script>
  const vex = new VexID({
    clientId: 'YOUR_CLIENT_ID',
    redirectUri: window.location.origin + '/callback',
  });

  document.getElementById('signin').onclick = async () => {
    const session = await vex.signInWithPopup();
    console.log('Hello,', session.user.name, session.user.email);
  };
</script>

GET /oauth2/authorize?response_type=code
    &client_id=YOUR_CLIENT_ID
    &redirect_uri=https://yourapp.example/callback
    &scope=openid%20profile%20email
    &state=RANDOM_STATE
    &code_challenge=BASE64URL_SHA256_OF_VERIFIER
    &code_challenge_method=S256 HTTP/1.1
Host: auth.arioron.com

curl -X POST https://auth.arioron.com/oauth2/token \
  -u "CLIENT_ID:CLIENT_SECRET" \
  -d grant_type=authorization_code \
  -d code=AUTHORIZATION_CODE \
  -d redirect_uri=https://yourapp.example/callback \
  -d code_verifier=CODE_VERIFIER

import requests

token = requests.post("https://auth.arioron.com/oauth2/token", auth=("CLIENT_ID", "CLIENT_SECRET"), data={
    "grant_type": "authorization_code",
    "code": code,
    "redirect_uri": "https://yourapp.example/callback",
    "code_verifier": code_verifier,
}).json()

const res = await fetch('https://auth.arioron.com/oauth2/token', {
  method: 'POST',
  headers: { Authorization: 'Basic ' + Buffer.from('CLIENT_ID:CLIENT_SECRET').toString('base64') },
  body: new URLSearchParams({
    grant_type: 'authorization_code',
    code,
    redirect_uri: 'https://yourapp.example/callback',
    code_verifier: codeVerifier,
  }),
});
const token = await res.json();

{
  "access_token": "uMjVq2…",
  "token_type": "Bearer",
  "expires_in": 864000,
  "refresh_token": "Hc7kP0…",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6…",
  "scope": "openid profile email"
}

curl https://auth.arioron.com/oauth2/userinfo -H "Authorization: Bearer ACCESS_TOKEN"

{
  "sub": "8b0c6c3e-2f4a-4e8e-9d1b-6a0f3c2b7e51",
  "name": "Ada Lovelace",
  "preferred_username": "ada",
  "picture": "https://…",
  "email": "ada@example.com",
  "email_verified": true
}

const vex = new VexID({ clientId: 'YOUR_CLIENT_ID', redirectUri: location.origin + '/callback' });

button.addEventListener('click', async () => {
  try {
    const session = await vex.signInWithPopup();
    // session.user, session.accessToken, session.idToken
  } catch (err) {
    if (err.code === 'popup_closed') return;           // they closed the window
    if (err.code === 'popup_blocked') vex.signInWithRedirect();
    else console.error(err.code, err.message);
  }
});

// Open the window first (inside the click handler) so it isn't blocked.
const popup = window.open('', 'vexid', 'popup=yes,width=480,height=680');
popup.location = 'https://auth.arioron.com/oauth2/authorize?' + new URLSearchParams({
  response_type: 'code', client_id: 'YOUR_CLIENT_ID',
  redirect_uri: 'https://yourapp.example/callback',
  scope: 'openid profile email', state, code_challenge, code_challenge_method: 'S256',
  response_mode: 'web_message', display: 'popup',
});

window.addEventListener('message', (e) => {
  if (e.origin !== 'https://auth.arioron.com' || e.source !== popup) return;
  if (e.data?.source !== 'vexid') return;
  const { code, state: returned, error } = e.data.response;
  // check returned === state, then exchange the code
});

const vex = new VexID({ clientId: 'YOUR_CLIENT_ID', redirectUri: 'https://yourapp.example/callback', exchange: 'server' });
const { code, codeVerifier, redirectUri } = await vex.signInWithPopup();
await fetch('/auth/vexid', { method: 'POST', body: JSON.stringify({ code, codeVerifier, redirectUri }) });

await vex.signInWithPopup({ prompt: 'select_account' });

GET /oauth2/authorize?…&prompt=select_account HTTP/1.1

await vex.signInWithPopup({ loginHint: 'ada@example.com' });

const vex = new VexID({
  clientId: 'YOUR_PUBLIC_CLIENT_ID',
  redirectUri: location.origin + '/callback',
  scope: 'openid profile email offline_access',   // offline_access: get a refresh token
});

// On your sign-in button: redirect instead of a popup
await vex.signInWithRedirect({ returnTo: location.href });

// On /callback
const session = await vex.handleRedirectCallback();
location.replace(session.returnTo || '/');

// Later
vex.onAuthStateChanged((user) => render(user));
const fresh = await vex.refresh();   // new access token when it expires

# pip install flask authlib requests
from flask import Flask, redirect, session, url_for
from authlib.integrations.flask_client import OAuth

app = Flask(__name__)
app.secret_key = "change-me"

oauth = OAuth(app)
oauth.register(
    "vexid",
    client_id="YOUR_CLIENT_ID",
    client_secret="YOUR_CLIENT_SECRET",
    server_metadata_url="https://auth.arioron.com/oauth2/.well-known/openid-configuration",
    client_kwargs={"scope": "openid profile email", "code_challenge_method": "S256"},
)

@app.route("/login")
def login():
    return oauth.vexid.authorize_redirect(url_for("callback", _external=True))

@app.route("/callback")
def callback():
    token = oauth.vexid.authorize_access_token()   # checks state, PKCE and the ID token
    session["user"] = token["userinfo"]
    return redirect("/")

# pip install authlib requests
from authlib.common.security import generate_token
from authlib.integrations.requests_client import OAuth2Session

client = OAuth2Session(
    "YOUR_CLIENT_ID", "YOUR_CLIENT_SECRET",
    scope="openid profile email",
    redirect_uri="https://yourapp.example/callback",
    code_challenge_method="S256",
)

code_verifier = generate_token(48)   # keep it, and state, in the user's session
url, state = client.create_authorization_url("https://auth.arioron.com/oauth2/authorize", code_verifier=code_verifier)

# on your callback
token = client.fetch_token("https://auth.arioron.com/oauth2/token",
                           authorization_response=callback_url, code_verifier=code_verifier)
user = client.get("https://auth.arioron.com/oauth2/userinfo").json()

// npm install openid-client@5
import { Issuer, generators } from 'openid-client';

const vex = await Issuer.discover('https://auth.arioron.com/oauth2');
const client = new vex.Client({
  client_id: 'YOUR_CLIENT_ID',
  client_secret: 'YOUR_CLIENT_SECRET',
  redirect_uris: ['https://yourapp.example/callback'],
  response_types: ['code'],
});

const code_verifier = generators.codeVerifier();   // keep it in the user's session
const url = client.authorizationUrl({
  scope: 'openid profile email',
  code_challenge: generators.codeChallenge(code_verifier),
  code_challenge_method: 'S256',
});

// on your callback
const tokens = await client.callback('https://yourapp.example/callback', client.callbackParams(req), { code_verifier });
const user = await client.userinfo(tokens.access_token);

curl -X POST https://auth.arioron.com/oauth2/token \
  -u "CLIENT_ID:CLIENT_SECRET" \
  -d grant_type=refresh_token \
  -d refresh_token=REFRESH_TOKEN

curl -X POST https://auth.arioron.com/oauth2/token -u "CLIENT_ID:CLIENT_SECRET" -d grant_type=client_credentials

{
  "iss": "https://auth.arioron.com/oauth2",
  "sub": "8b0c6c3e-2f4a-4e8e-9d1b-6a0f3c2b7e51",
  "aud": "YOUR_CLIENT_ID",
  "iat": 1791705600,
  "exp": 1791709200,
  "auth_time": 1791705590,
  "nonce": "RANDOM_NONCE",
  "email": "ada@example.com",
  "email_verified": true
}

import requests
from authlib.jose import JsonWebKey, jwt

jwks = JsonWebKey.import_key_set(requests.get("https://auth.arioron.com/oauth2/.well-known/jwks.json").json())
claims = jwt.decode(id_token, jwks, claims_options={
    "iss": {"essential": True, "value": "https://auth.arioron.com/oauth2"},
    "aud": {"essential": True, "value": "YOUR_CLIENT_ID"},
})
claims.validate()   # exp, iat and the options above

await vex.signOut();                       // your app only (revokes the refresh token)
await vex.signOut({ everywhere: true });   // and Vex ID, then back to your redirect URI

GET /oauth2/logout?id_token_hint=ID_TOKEN
    &post_logout_redirect_uri=https://yourapp.example/
    &state=RANDOM_STATE HTTP/1.1
Host: auth.arioron.com

{ "error": "invalid_grant", "error_description": "Invalid \"code\" in request." }