Documentation/Getting started/Prerequisites

Prerequisites

What your entity needs ready before requesting sandbox access.

On your side (Relying Party)

A certified OIDC library (list on openid.net), or an OAuth 2.0 library combined with a JWT library. With an OAuth 2.0 library alone you configure the endpoints by hand and validate the id_token yourself.
A callback URL strictly identical to one of the registered redirect URIs. A single character of difference causes a redirect_uri error.
A server able to exchange the code for tokens at the token endpoint, with client_id and client_secret (client_secret_basic). The secret must never be exposed in the browser.
id_token verification: signature through the jwks endpoint, state and nonce.
Delayed sharing (optional): a client_credentials token with the private:delayed_sharing scope, and keeping non-empty claims, since the user may delete them.
Webhook (optional): a public HTTPS endpoint that answers 200, 201 or 204, verifies the X-Webhook-Signature header and deduplicates on id. For local tests, a public tunnel (ngrok, for example) to your server.

On A3BC’s side

Endpoint	Role	Sandbox
Discovery	Lists all endpoints	`https://oidc-sandbox.a3bc.io/.well-known/openid-configuration`
Authorization	User redirection	`https://oidc-sandbox.a3bc.io/oauth2/auth`
Token	Code exchange, `client_credentials`	`https://oidc-sandbox.a3bc.io/oauth2/token`
JWKS, userinfo, document	Given by the discovery and by claims	see the discovery

Production URLs are not public: A3BC provides them during onboarding.

Test environment

Testers receive the TrustMe sandbox app through an email invitation (Firebase on Android, TestFlight on iOS). The access request therefore collects their addresses and platform.