Quickstart
A first complete OIDC journey, from redirect to reading the claims.
This walkthrough assumes you received a sandbox client_id and client_secret, and that your redirect_uri is registered.
1. Read the discovery
curl -s https://oidc-sandbox.a3bc.io/.well-known/openid-configuration
The response contains authorization_endpoint, token_endpoint, jwks_uri and userinfo_endpoint.
2. Redirect the user
Generate a random state and nonce, keep them server-side (session), then redirect to the authorization endpoint.
https://oidc-sandbox.a3bc.io/oauth2/auth
?response_type=code
&client_id=<client_id>
&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
&scope=openid%20profile%20email
&state=<state>
&nonce=<nonce>
import secrets, urllib.parse
state, nonce = secrets.token_urlsafe(24), secrets.token_urlsafe(24)
params = {
"response_type": "code",
"client_id": CLIENT_ID,
"redirect_uri": REDIRECT_URI,
"scope": "openid profile email",
"state": state,
"nonce": nonce,
}
url = "https://oidc-sandbox.a3bc.io/oauth2/auth?" + urllib.parse.urlencode(params)
import { randomBytes } from "node:crypto";
const state = randomBytes(24).toString("base64url");
const nonce = randomBytes(24).toString("base64url");
const url = new URL("https://oidc-sandbox.a3bc.io/oauth2/auth");
url.search = new URLSearchParams({
response_type: "code",
client_id: CLIENT_ID,
redirect_uri: REDIRECT_URI,
scope: "openid profile email",
state,
nonce,
}).toString();
3. Receive the callback
The user authenticates and consents in the TrustMe app, then comes back to your redirect_uri?code=…&state=…. Compare state with the stored value before doing anything else.
4. Exchange the code
curl -s -u "$CLIENT_ID:$CLIENT_SECRET" \
-d grant_type=authorization_code \
-d code="$CODE" \
--data-urlencode redirect_uri="$REDIRECT_URI" \
https://oidc-sandbox.a3bc.io/oauth2/token
import requests
r = requests.post(
"https://oidc-sandbox.a3bc.io/oauth2/token",
auth=(CLIENT_ID, CLIENT_SECRET), # client_secret_basic
data={"grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI},
timeout=15,
)
r.raise_for_status()
tokens = r.json() # access_token, id_token, ...
const basic = Buffer.from(`${CLIENT_ID}:${CLIENT_SECRET}`).toString("base64");
const res = await fetch("https://oidc-sandbox.a3bc.io/oauth2/token", {
method: "POST",
headers: { Authorization: `Basic ${basic}`, "Content-Type": "application/x-www-form-urlencoded" },
body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: REDIRECT_URI }),
});
if (!res.ok) throw new Error(await res.text());
const tokens = await res.json();
5. Verify the id_token and read the claims
Verify the signature (keys from jwks_uri), issuer, audience, expiry and nonce, as described in Verify the tokens. Requested claims that are unavailable are simply absent: check that you have everything you need.