Continue with SeleID (OIDC) API

GET /.well-known/openid-configuration

OpenID Connect discovery document

No authentication.

curl

curl -X GET "https://auth.seleid.dev/.well-known/openid-configuration"

TypeScript

const res = await fetch('https://auth.seleid.dev/.well-known/openid-configuration', {
  method: 'GET',
});
const data = await res.json();

Python

import os, requests

res = requests.get(
    "https://auth.seleid.dev/.well-known/openid-configuration"
)
print(res.status_code, res.text)

Example response

{
  "issuer": "https://auth.seleid.dev",
  "authorization_endpoint": "https://auth.seleid.dev/authorize",
  "token_endpoint": "https://auth.seleid.dev/oauth/token",
  "jwks_uri": "https://auth.seleid.dev/.well-known/jwks.json",
  "response_types_supported": [
    "code"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email"
  ]
}

GET /.well-known/jwks.json

Public signing keys (JWKS)

No authentication.

curl

curl -X GET "https://auth.seleid.dev/.well-known/jwks.json"

TypeScript

const res = await fetch('https://auth.seleid.dev/.well-known/jwks.json', {
  method: 'GET',
});
const data = await res.json();

Python

import os, requests

res = requests.get(
    "https://auth.seleid.dev/.well-known/jwks.json"
)
print(res.status_code, res.text)

GET /authorize

Start sign-in (open in the system browser). Requires client_id, an exact registered redirect_uri, response_type=code, scope including openid, state, a nonce of 16 to 256 characters and an S256 code_challenge of 43 to 128 characters. On success the person returns to redirect_uri with code and state.

No authentication.

curl

curl -X GET "https://auth.seleid.dev/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=YOUR_RESPONSE_TYPE&scope=YOUR_SCOPE&state=YOUR_STATE&nonce=YOUR_NONCE&code_challenge=YOUR_CODE_CHALLENGE&code_challenge_method=YOUR_CODE_CHALLENGE_METHOD"

TypeScript

const res = await fetch('https://auth.seleid.dev/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=YOUR_RESPONSE_TYPE&scope=YOUR_SCOPE&state=YOUR_STATE&nonce=YOUR_NONCE&code_challenge=YOUR_CODE_CHALLENGE&code_challenge_method=YOUR_CODE_CHALLENGE_METHOD', {
  method: 'GET',
});
const data = await res.json();

Python

import os, requests

res = requests.get(
    "https://auth.seleid.dev/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=YOUR_RESPONSE_TYPE&scope=YOUR_SCOPE&state=YOUR_STATE&nonce=YOUR_NONCE&code_challenge=YOUR_CODE_CHALLENGE&code_challenge_method=YOUR_CODE_CHALLENGE_METHOD"
)
print(res.status_code, res.text)

POST /oauth/token

Exchange a code or refresh a token

No authentication.

curl

curl -X POST "https://auth.seleid.dev/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'grant_type=authorization_code&code=CODE&redirect_uri=com.example.app%3A%2Fseleid&client_id=YOUR_CLIENT_ID&code_verifier=VERIFIER'

TypeScript

const res = await fetch('https://auth.seleid.dev/oauth/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({"grant_type":"authorization_code","code":"CODE","redirect_uri":"com.example.app:/seleid","client_id":"YOUR_CLIENT_ID","code_verifier":"VERIFIER"}),
});
const data = await res.json();

Python

import os, requests

res = requests.post(
    "https://auth.seleid.dev/oauth/token",
    data={
        "grant_type": "authorization_code",
        "code": "CODE",
        "redirect_uri": "com.example.app:/seleid",
        "client_id": "YOUR_CLIENT_ID",
        "code_verifier": "VERIFIER",
    }
)
print(res.status_code, res.text)

Example response

{
  "access_token": "opaque",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "opaque",
  "id_token": "eyJ…",
  "scope": "openid profile email"
}

GET /oauth/userinfo

Profile claims for the access token. Advertised only when outside-app sign-in is on.

Authentication: required.

curl

curl -X GET "https://auth.seleid.dev/oauth/userinfo" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

TypeScript

const res = await fetch('https://auth.seleid.dev/oauth/userinfo', {
  method: 'GET',
  headers: { Authorization: `Bearer ${process.env.ACCESS_TOKEN}` },
});
const data = await res.json();

Python

import os, requests

res = requests.get(
    "https://auth.seleid.dev/oauth/userinfo",
    headers={"Authorization": f"Bearer {os.environ['ACCESS_TOKEN']}"}
)
print(res.status_code, res.text)

Example response

{
  "sub": "user_123",
  "name": "Ada",
  "email": "ada@example.com",
  "email_verified": true
}

POST /oauth/revoke

Revoke a refresh or access token. Advertised only when outside-app sign-in is on.

No authentication.

curl

curl -X POST "https://auth.seleid.dev/oauth/revoke" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'token=YOUR_TOKEN&client_id=YOUR_CLIENT_ID'

TypeScript

const res = await fetch('https://auth.seleid.dev/oauth/revoke', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({ token: "YOUR_TOKEN", client_id: "YOUR_CLIENT_ID" }),
});
const data = await res.json();

Python

import os, requests

res = requests.post(
    "https://auth.seleid.dev/oauth/revoke",
    data={
        "token": "YOUR_TOKEN",
        "client_id": "YOUR_CLIENT_ID",
    }
)
print(res.status_code, res.text)