Quickstart¶

Ten minutes, and the first five are reading.

1. Register your site¶

Open auth.omxus.com/developers, give your site a name and its redirect URI, and leave with a client_id. Or do the same in one call:

curl -s https://auth.omxus.com/oidc/register \
  -H 'content-type: application/json' \
  -d '{
    "client_name": "My Site",
    "redirect_uris": ["https://mysite.com/callback"],
    "token_endpoint_auth_method": "client_secret_post"
  }'

The answer carries client_id and, because this asks for a server-side client, client_secret. The secret is shown once: only its hash is kept. Leave out token_endpoint_auth_method for a browser app with no server; it then gets no secret. Every field, rule and error: Registering a site.

The redirect URI is matched exactly: no wildcards, no trailing-slash forgiveness.

2. Point your auth library at the issuer¶

Ask for the profile scope: without it the token carries sub and nothing else. PKCE is required for every client, with or without a secret.

providers: [{
  id: 'omxus',
  name: 'Omxus',
  type: 'oidc',
  issuer: 'https://auth.omxus.com',
  clientId: process.env.OMXUS_CLIENT_ID,
  clientSecret: process.env.OMXUS_CLIENT_SECRET,
  checks: ['pkce', 'state'],
  authorization: { params: { scope: 'openid profile' } },
}]

import passport from 'passport';
import { discovery } from 'openid-client';
import { Strategy } from 'openid-client/passport';

const config = await discovery(
  new URL('https://auth.omxus.com'),
  process.env.OMXUS_CLIENT_ID,
  process.env.OMXUS_CLIENT_SECRET);

passport.use('omxus', new Strategy(
  { config, scope: 'openid profile', callbackURL: 'https://mysite.com/callback' },
  (tokens, done) => done(null, tokens.claims())));

discovery  https://auth.omxus.com/.well-known/openid-configuration

3. There is no step three¶

Send someone to sign in. The first time, they press once to let your site in; after that they come straight back with a session.

What you get back¶

The ID token, with scope openid profile:

{
  "iss": "https://auth.omxus.com",
  "sub": "23cf34129785242b1ea072ec3669a3af6af2528b",
  "aud": "q3V8n0bX1kZ2mH7cT9wLpA",
  "iat": 1793318400,
  "exp": 1793322000,
  "auth_time": 1793318395,
  "omxus_address": "0xc6140a760bfbc99428a8e53a08546657fad14c76"
}

nonce is there too when you sent one. ID and access tokens last one hour.