Sign in with Tringify

OAuth Apps are confidential OpenID Connect clients for Sign in with Tringify. They identify Tringify account users to a server-backed application; they are not installed into stores and their access tokens do not authorize Store API requests.

Create and activate the client#

Create the OAuth app inside its owning organization. The client secret is displayed once; store it in the application's server-side secret manager.
Register every redirect URI exactly as it will appear in authorization and token requests. Public callbacks require HTTPS; loopback HTTP callbacks are accepted for local development.
Activate the client. Activation requires an approved developer profile and at least one registered redirect URI. Draft and disabled clients cannot authorize or exchange codes.

Discover the OpenID configuration#

Use https://api.tringify.com/.well-known/openid-configuration as the source of the authorization, token, UserInfo, and JWKS endpoints and the current issuer. At publication, the issuer is https://accounts.tringify.com; protocol endpoints are on https://api.tringify.com.

Start authorization#

authorization-request.txt text

GET {authorization_endpoint}?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_EXACT_REDIRECT_URI&scope=openid%20email&state=FRESH_STATE&nonce=FRESH_NONCE&code_challenge=BASE64URL_SHA256_VERIFIER&code_challenge_method=S256

Generate independent, unpredictable state, nonce, and PKCE verifier values for each authorization request and retain them in the initiating server session. Request openid; add profile and email only when required. Redirect URIs are matched byte for byte.

Validate the callback#

The callback contains code, state, and iss. Reject a missing or mismatched state or issuer before exchanging the code. Authorization codes are single-use and expire after 10 minutes.

Exchange the code#

bash

curl -X POST https://api.tringify.com/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=authorization_code' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \
  --data-urlencode 'code=CODE_FROM_CALLBACK' \
  --data-urlencode 'redirect_uri=YOUR_EXACT_REDIRECT_URI' \
  --data-urlencode 'code_verifier=YOUR_ORIGINAL_CODE_VERIFIER'

Verify the id_token with the discovery document's jwks_uri. Validate its RS256 signature, iss, aud, exp, and nonce; reject a nonce that does not match the initiating authorization request. The bearer access token may call the discovered userinfo_endpoint while valid. Third-party OAuth Apps do not receive refresh tokens; reauthorize when identity must be established again.

Disable, rotate, or delete#

Disabling a client immediately blocks new authorization, code exchange, and UserInfo requests. An ID token already issued remains independently verifiable until its exp. Rotating the client secret invalidates the previous secret for future exchanges but does not revoke existing access tokens or grants. Deleting the client is permanent, removes its server-side authorization data, and requires organization identity verification.