Sign in with AureScore.

Overview

AureScore acts as an OpenID Connect identity provider. Your server redirects the browser to AureScore, receives a short-lived one-time authorization code, and exchanges it from your backend. Keep the client secret and token exchange out of browser JavaScript.

Quickstart

1. 1. Register a confidential OAuth application in the developer area.
2. 2. Generate a cryptographically random state and PKCE verifier on your server.
3. 3. Redirect the browser to the authorization endpoint.
4. 4. Validate state, then exchange the code from your backend.
5. 5. Validate the returned ID token and optionally call UserInfo.

GET https://api.aurescore.okoyedavid.com/api/oauth/authorize
  ?client_id=auc_example
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
  &response_type=code
  &scope=openid%20profile%20email
  &state=<random-state>
  &code_challenge=<base64url-sha256>
  &code_challenge_method=S256

Register an app

Provide a name, exact redirect URIs, and the scopes your app may request. Redirect URIs must use HTTPS, except HTTP loopback addresses for local development, and cannot contain a query or fragment. Save the one-time secret immediately in a server-side secret manager.

Authorization Code + PKCE

Use S256 PKCE for every authorization request. Authorization codes are single-use and expire after two minutes. The token request must authenticate the confidential client and present the original verifier.

curl -X POST https://api.aurescore.okoyedavid.com/api/oauth/token \
  -u 'auc_example:YOUR_SERVER_SIDE_SECRET' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'code=ONE_TIME_CODE' \
  --data-urlencode 'redirect_uri=https://app.example.com/callback' \
  --data-urlencode 'code_verifier=ORIGINAL_PKCE_VERIFIER'

Endpoints

Scopes and claims

Token validation

Fetch signing keys from JWKS and verify the ID token signature, issuer, audience, expiry, and nonce when supplied. Cache keys according to response headers and support key rotation. Access tokens are opaque, expire after ten minutes, and should not be parsed by clients.

UserInfo

Call UserInfo from your server with the opaque bearer access token. Returned claims are limited by the granted scopes. Treat absent optional claims as normal.

curl https://api.aurescore.okoyedavid.com/api/oauth/userinfo \
  -H 'Authorization: Bearer ACCESS_TOKEN'

Errors

Authorization failures return standard OAuth error values to a validated redirect URI. Token failures use JSON error responses. Show safe messages to users, retain state correlation, and never expose client secrets or raw provider details in logs or URLs.

Security

1. 1. Generate state, nonce, and PKCE values with a cryptographically secure random source.
2. 2. Keep secrets and token exchanges on your server.
3. 3. Use exact redirect matching and HTTPS in production.
4. 4. Use short-lived server sessions and protect callback endpoints against CSRF.
5. 5. Rotate a secret immediately if it may have been exposed.

Production checklist

1. 1. Use the production issuer and discovery document.
2. 2. Store the client secret in a managed secret store.
3. 3. Validate ID tokens against the production JWKS and expected audience.
4. 4. Confirm every production redirect URI is exact and HTTPS.
5. 5. Test denied consent, expired codes, state mismatch, and key rotation.
6. 6. Do not expect refresh tokens in this release.