Authie.Start building
Authentication

Use the standard OIDC flow.

Authie hosts signup, login, consent, password recovery, token issuance, and discovery. Your application owns its local session and protected routes.

Authorization Code with PKCE

  1. Start the authorization.Generate cryptographically random state, nonce, and a PKCE verifier with its S256 challenge.
  2. Redirect to Authie.Your OIDC library uses discovery to find the authorization endpoint.
  3. Handle the exact callback URI.Compare state exactly, exchange the short-lived code, and provide the PKCE verifier.
  4. Validate the response.Verify issuer, audience/client ID, signature, expiry, nonce, and authorized-party claims.
  5. Create your application session.Use a narrow, secure, HTTP-only cookie or a server-side session store.

Discovery

Do not hard-code individual OAuth endpoints. Configure the issuer and fetch its discovery document.

Issuer
https://authie.ai/api/auth

Discovery
https://authie.ai/api/auth/.well-known/openid-configuration

Client types

Confidential client

For applications with a trusted backend. Keep the client secret, access tokens, and refresh tokens server-side.

Public client

For mobile, desktop, browser-only, and CLI applications that cannot protect a secret. S256 PKCE is mandatory; no client secret is issued.

Session and token rules

  • Keep cookies HttpOnly and Secure in production.
  • Use SameSite=Lax unless a tested cross-site design requires otherwise.
  • Rotate refresh tokens and invalidate the local session if refresh fails.
  • Never log authorization codes, tokens, secrets, or full callback URLs.
  • Use the access token—not the ID token—to call resource APIs.
  • Never parse a JWT without verifying it through a maintained library.